Connect
A capability with no declared shape cannot be reviewed.
Every tool in the registry publishes five things before any agent can hold it. This is the difference between a permission system and a hopeful one: you can only decide whether an agent should have a capability if you can see what that capability actually does.
Inputs, typed and bounded
A tool that takes a customer reference takes a customer reference — not an arbitrary query string that happens to usually contain one. Bounded inputs are what stop a capability being wider than its name suggests.
Outputs, so you know what the agent learned
The declared return shape tells you what data reached the agent's context. "Read customer" returning a full payment history is a different risk from one returning a name and a status.
A risk level, assigned by consequence
Low, medium, high or critical — based on what happens if the call is wrong, not on how complicated it was to build. Policies attach to this level rather than to individual tool names.
Approval behaviour, declared not configured
Some capabilities carry a mandatory approval that no configuration removes. A tool that can move money is one of them, and that is a property of the tool rather than a setting on the agent.
Tools
The rest of this area.
Named capabilities with defined inputs, outputs and risk.
The tool registry
Every capability an agent could be given, in one list.
Risk levels
Four levels, and the policies that attach to them.
Your business as a toolbox
Connected systems become capabilities, not open access.
Your own tools
Expose your own service as a permissioned capability.
Adding external systems
The same architecture, more tools. No redesign.
Give AI a job.
Build an agent, choose what it can access, define what it may do, and deploy it to work safely across your business.
No code required · Full SDKs and API · Stop any agent instantly · [email protected]