Permit
Permissions decay. Reviews are scheduled.
The usual way an agent becomes dangerous is not a bad decision at the start — it is six small, reasonable additions over a year, each made for a good reason that no longer applies. Every agent carries a review date and a record of when each capability was added and by whom.
Each grant records who and why
A capability with an author and a reason can be evaluated later. One that simply exists can only be left alone, because nobody knows what removing it would break.
Unused capabilities are surfaced
The review shows which granted capabilities the agent has not called in ninety days. That list is almost always the right place to start.
Reviews are somebody's job, by name
The review lands on the owner, with a date. A governance process that belongs to everybody belongs to nobody.
Overdue reviews are visible, not enforced by shutdown
An overdue review flags the agent in the directory and notifies the owner. It does not stop the agent, because breaking a working finance process to enforce a calendar is a worse outcome than a late review.
Permissions
The rest of this area.
Three states per capability, and the default is never.
Grants and scopes
Allow, approve or never — per capability, per agent.
Authority
Holding a tool is not the same as being allowed to use it freely.
Boundaries
What an agent can never do, however it is configured.
Secrets
Agents never hold credentials. Ever.
Network policy
Where an agent may reach, and nowhere else.
Give AI a job.
Build an agent, choose what it can access, define what it may do, and deploy it to work safely across your business.
No code required · Full SDKs and API · Stop any agent instantly · [email protected]