Permit
An agent's reach is a list, not the internet.
Each agent runs behind a boundary that allows the endpoints its granted tools need and refuses everything else. The default is no outbound access at all. An agent that only reads invoices and sends mail has no route to an arbitrary address, so it has no route to send your data to one.
Default deny, outbound
Nothing is reachable until a granted tool makes it reachable. This is the control that makes the difference between an agent that could leak data and one that cannot.
Four settings, in plain words
Connected tools only; connected tools plus named external APIs; a custom allowlist; or no outbound access whatsoever. Chosen per agent and shown on its profile.
Blocked attempts are recorded
A refused connection is logged against the agent and its version. An agent repeatedly trying to reach an address nobody granted is worth knowing about, whatever the reason.
Rate limits and anomaly detection at the boundary
Sudden volume, unusual call patterns and repeated failures are caught at the gateway rather than inside each agent, and can pause the agent automatically.
Permissions
The rest of this area.
Three states per capability, and the default is never.
Grants and scopes
Allow, approve or never — per capability, per agent.
Authority
Holding a tool is not the same as being allowed to use it freely.
Boundaries
What an agent can never do, however it is configured.
Permission reviews
Access granted for a reason that expired is the common failure.
Secrets
Agents never hold credentials. Ever.
Give AI a job.
Build an agent, choose what it can access, define what it may do, and deploy it to work safely across your business.
No code required · Full SDKs and API · Stop any agent instantly · [email protected]