Permit
Three states, and you can see all of them at once.
The permissions screen is a table: capabilities down the side, one of three grants against each. It is deliberately boring to read and impossible to misread, because it is the screen somebody signs off on before an agent touches a customer.
Allow — unattended
The agent may do this whenever its job requires it, without asking. Reserved for things that are recoverable and expected.
Approve — a named human decides
The agent may prepare the action and must wait. The request names who can decide it, and the agent continues with the rest of its work meanwhile rather than stalling.
Never — and it stays never
Refused at the point of the call, not by instructing the model not to try. A boundary that depends on the model choosing to respect it is not a boundary.
Scoped as narrowly as the data allows
Not just "read customers" but which customers: its own assigned accounts, one team's, one region's. An agent that needs three accounts should not be able to read three thousand.
Permissions
The rest of this area.
Three states per capability, and the default is never.
Authority
Holding a tool is not the same as being allowed to use it freely.
Boundaries
What an agent can never do, however it is configured.
Permission reviews
Access granted for a reason that expired is the common failure.
Secrets
Agents never hold credentials. Ever.
Network policy
Where an agent may reach, and nowhere else.
Give AI a job.
Build an agent, choose what it can access, define what it may do, and deploy it to work safely across your business.
No code required · Full SDKs and API · Stop any agent instantly · [email protected]