Concepts overview

An agent that can call tools can be induced to call them by anyone whose text reaches its context — a README, a ticket, a web page. The model cannot reliably tell instructions from data, so the boundary that decides whether a call actually happens has to live outside the model. Everything below is a piece of that boundary.

Seven ideas

• Agent identity — a workload identity bound to what the agent runs as, with an accountable owner and a scope, so an action can always be traced to a person.
• Policy — the ordered rule set that decides permit, forbid, or a hold, evaluated identically wherever it runs.
• Secret handle — an opaque string the agent holds instead of a credential; the real value is substituted at the boundary, after policy has authorized the destination.
• Approval — the point where a policy resolves to a hold and a person is asked, without the agent's run dying.
• Execution graph — the recorded shape of a run: every call, every decision, every latency, as structure rather than a chat transcript.
• Audit chain — the append-only, hash-chained record of every decision, built so tampering after the fact is detectable.
• Decision path — the order these pieces actually run in: agent, intercept, authorize, broker, record.

Where to go next