Use case · By risk
Scope every tool an agent can use.
Each tool is allowed per role and per action, read first.
“Agents connect to tools and servers nobody reviewed.”
Control in three steps
Each tool is allowed per role and per action, read first.
Check who is asking
Every person and agent is named, with a role from your directory.
Allow, ask or decline
Inside the role it runs. Changes wait. Outside the role, declined.
Record it
Every step lands in the audit trail.
See it work
Watch it happen.
Step 1 of 4: Request
“Initiate a refund of KES 12,000 to account ending 4471.”
Every request starts with a named person and a named agent.
Simplified example. Names and records are invented.
Text version
Ops agent (Operations) asks Operations agent: "Initiate a refund of KES 12,000 to account ending 4471." The role check returns: Declined. Every step is written to the audit log.
01 Request
Ops agent · Operations · Operations agent
Initiate a refund of KES 12,000 to account ending 4471.
02 Role check
Declined
- Role
- Operations agent (from your directory)
- Read
- Allowed
- Change
- Not allowed for this role
The payments tool is outside this agent's scope. Declined.
03 Human approval
Not needed
Declined at the role check. It never reached an approver.
04 Audit log
- 09:14:02 · request · ops-agent · ops-agent · payments.refund
- 09:14:02 · policy · role=ops-agent · read=allow · change=deny
- 09:14:02 · declined · tool outside scope · payments.refund
- 09:14:02 · logged · event 7f3a…e21 · on the record
Questions
Short answers. Ask us anything else on the call.
See this in your own organisation.
Start with a free assessment. Two weeks. Read-only.
A one-page answer for your CEO and CISO. Assessments are offered at our discretion.