Part 2 — For the Developer
Ch. 12 — What Agents Are Allowed to Do — Permission Models and Action Boundaries
Designing the action layer — what agents can call, write, send, and execute, and how to enforce those limits.
Knowing who the agent is solves half the problem. The other half is what it can do. These are separate concerns. Conflating them is a design error that shows up in almost every first-generation agent system.
12.1 Key Takeaways
Identity governs what data an agent can see. The action layer governs what the agent can do with it. An agent authenticated as a service account with broad read access can still be prohibited from sending messages, executing code, or writing records. Designing these constraints separately gives you two independent control surfaces — and two independent audit trails.
Platform Agentic
Compliance, governance, and accountability for teams building agentic AI systems.