The right question before letting an AI agent in is not how smart it is. It is what it can touch. Here the answer is not a policy in a PDF: it is in how the tools are handed to it, and it can be read.
The tools the agent has in each conversation are computed at send time, from the modules the person writing can see. There is no agent permission list anyone can edit: it inherits, and nothing else.
An agent with access to everything is an employee with access to everything, who never gets tired of searching. The question is not whether it is trustworthy: it is how far it reaches.
If the owner instructions could change the rules, anyone with access to the brief could open the door to data that is not theirs.
Delete, change a price, charge. An agent that can write where it should not is worse than one that is useless.
Tools come from the role and modules of whoever asks, computed at every message. A branch manager talking to the agent gets a branch agent.
What the owner writes to the agent is appended at the end, below the rules and the module list, with a line saying it does not change them. An "ignore the above" sits below what it wants to ignore.
If you ask for data from a module your role does not have, the tool answers that you do not have permission. There is no summary version and no "just this once".
Thirteen tools: summaries of tickets, finance, documents, kitchen, stock and loyalty; create a task, book a meeting, add a card to the board, switch on a module. None deletes, none changes a price, none charges.
| An assistant with its own access | Delorean | |
|---|---|---|
| Where its permissions come from | From an assistant configuration, separate from people | From the role of the person writing to it, at every message |
| If the brief says "ignore the rules" | Depends on how the prompt is written | Changes nothing: the brief goes after the rules and says so |
| A module the person does not see | The assistant may see it anyway, if its access includes it | Answers that you do not have permission |
| Delete | If it has the tool, it deletes | It does not have the tool |
| Change a price or charge | Same | The tool does not exist |
| External guests | Per configuration | Do not use the agent |
| How much it can consume | Until the bill arrives | Daily cap per plan, shown on screen |
| How to audit it | By reading the prompt | By reading the code: the tool list is the list |
Written from each product's public documentation. They are mature tools and this page says where they are still better. No prices here: they change on their own and the page would end up lying without anyone touching it.
The agent comes in with the role of whoever runs it. You write the brief and see, in the first conversation, what it answers and what it refuses.
Support, orders, the morning summary. Each with its brief and its schedule, all inheriting the same thing: what the person in charge sees.
Each person with their agent, with their permissions. The same rule for everyone, nothing configured per agent.
What the person writing to it sees: their modules and their branch. Computed at every message, not stored in the agent.
No. The owner brief goes after the rules and the module list, and says explicitly it does not change them.
It answers that you do not have permission to see that data. No exception.
No. It has no tool that deletes. It can create tasks, meetings and cards, and read summaries.
No. Those tools do not exist. The order agent sends your payment link and nothing else.
No. The agent refuses project guests.
There is a daily cap per plan, shown on screen before you reach it. No surprise bill.
By reading the tool list: thirteen, by name. What is not on the list, the agent cannot do.
It sits below the rules it wants to ignore. The system is built in that order on purpose.
Code. The policy is what this page says; the code is what enforces it. It can be requested for review.