Question 1

Where are permissions enforced?

Accepted Answer

At the tool-call boundary, outside the model — a clever prompt can ask for anything, but it can’t get past the gate.

Question 2

Can the same agent differ per person?

Accepted Answer

That is the default. Every request resolves against the acting user’s own access and overrides, so one deployment behaves differently for a team lead than for a new hire. No forked agents, no lowest common denominator.

Question 3

What happens if the agent is granted more than the user has?

Accepted Answer

The extra grant does nothing. Permission is the overlap of the two, so an agent allowed to issue refunds still cannot issue one for a person who has no refund access of their own.

Question 4

What does a blocked call look like?

Accepted Answer

Usually nothing: off-limits tools aren’t even visible to the agent. A call that arrives anyway is refused before it reaches the system.

Question 5

Who sets the permissions?

Accepted Answer

The people accountable for the systems — admins define org and team grants, scope sets cover the common cases, and per-user overrides handle the exceptions.

Question 6

Do changes require a redeploy?

Accepted Answer

No — policy is read live on each request. Tighten a grant and the very next call obeys it; there is nothing to ship or restart.

One agent. A different boundary for every person it acts for.

“This agent can use Slack” is not a permission model — a service account gives every agent the same access, for every person, all the time. The intern’s request and the CFO’s request come out of the same key.

What you get

Common questions