Minimal access
The necessary access depends on the materials: the sources, the permitted actions, the processing perimeter and the retention period are set before the start, and extra sources are not connected. This rule is fixed in the passports of the agents and in the security section.
Read-only in the architecture
The Database consultant forms SQL queries only to the permitted views of PostgreSQL: writing and changing data is forbidden at the architecture level, and the corporate access policies are not bypassed. The boundary does not depend on the wording of the question.
Untrusted content
An incoming letter is untrusted content: instructions inside the letter cannot redefine the criticality rules, the content filter blocks prompt injection, and the classification prompt is split into a protected contract and an editable business policy. For legal inquiries, the auto-generation of a reply is blocked entirely.
The human as the last boundary
Sending a letter, a legal position, a publication and any action that is hard to undo require the explicit confirmation of a human. The access boundaries plus the human confirmation are two halves of one principle: the agent works inside the perimeter, the decisions stay with the people.
Questions and answers
Can the access be extended after the start?
Yes, through an explicit change of permissions: new sources and actions are recorded in the passport and the journal, not connected silently.
What stops the agent from reading the whole database?
The role model: the agent sees only the permitted views granted to the specific role of the user.
Why is an incoming letter untrusted content?
Because it may contain instructions trying to redefine the behavior of the agent; the criticality rules are deterministic and cannot be redefined from a letter.
What is read-only access?
The agent sees only the permitted data and cannot change it: the connection to the database goes through views without write rights.
Why limit the actions of the agent?
The fewer permissions, the smaller the consequences of a mistake: every source and tool is connected separately.
Can the agent extend its own rights?
No: permissions are set before the start and fixed in the passport; a change is possible only by an explicit decision.
What are deterministic criticality rules?
Rules that cannot be redefined from the incoming content: a letter cannot change the behavior of the agent.
How to check what data the agent has seen?
By the journal: inputs, stages and decisions form a readable trace of the run.
What happens with a sensitive action?
The consequence is explained before the confirmation; without an explicit consent the action is not performed.
Where are the boundaries of each agent described?
In the passport: task, input, process, output, constraints, permissions, perimeter and verification — eight fields are documented.