The approver defines the boundary. The agent doesn’t get to interpret it.
Declare what each agent may do for each person — and enforce it at the tool-call boundary, not in the prompt.
The problem
“This agent can use Slack” is not a permission model — a service account gives an agent everything, for everyone.
Service accounts grant everything to everyone
Prompts ask; they can’t enforce
Permissions set once, reviewed never
The only boundary that holds sits outside the model
How a boundary gets enforced
Default-deny grants at org, team, and member level — scope sets make it reusable.
The acting user's identity travels with every request.
Allowed, held for approval, or denied — enforced outside the model.
Policy reads live per request — no redeploys, no stale rules.
See it
THE POLICY GATE DECIDES PER CALL — THE MODEL NEVER HOLDS THE RULES
Capabilities
What you get
The payoff
One permission model for every agent — set by the people accountable for it.
Questions
Common questions
Related solutions