Permit
Some things are not a setting.
A boundary is different from a permission set to never: a permission could be changed by an administrator, and a boundary cannot. Refunds, deletions, permission changes and contract issuance are refused by the platform regardless of plan, role or configuration.
Refused at the call, not in the prompt
The refusal happens in the platform, after the model has decided to try. Instructions in a system prompt are a request; this is a wall.
Not removable by an administrator
There is no toggle, no enterprise setting and no support request that grants an agent the ability to issue a refund. If that limit could be lifted under pressure, it was never a boundary.
Content cannot rewrite them
Emails, attachments, web pages and imported documents are data. An instruction inside a customer's message is treated as text the agent read, never as a rule the agent follows.
Stated on the agent's own profile
The boundaries appear on the profile whether or not anybody thought to consider them, so the person approving the agent sees what it cannot do as well as what it can.
Permissions
The rest of this area.
Three states per capability, and the default is never.
Grants and scopes
Allow, approve or never — per capability, per agent.
Authority
Holding a tool is not the same as being allowed to use it freely.
Permission reviews
Access granted for a reason that expired is the common failure.
Secrets
Agents never hold credentials. Ever.
Network policy
Where an agent may reach, and nowhere else.
Give AI a job.
Build an agent, choose what it can access, define what it may do, and deploy it to work safely across your business.
No code required · Full SDKs and API · Stop any agent instantly · [email protected]