Principles for bounded agent access

The animation explains the architecture; no live actions are executed.

I now use the Codex connection daily. This diagram describes design principles, not an independent test of every control.

Request

• Account + purpose

The agent describes a specific requested operation.

Caller & account

• Not just prompt text

The route must establish the caller and exact account before granting access.

Policy & approval

• Operation + validity

Policy determines scope, expiry and any required approval.

Permitted

• Bounded execution

Only the permitted operation may follow, without giving the account secret to the model.

Stop

• No code

Execution must stop when the account is ambiguous or permission is insufficient.

Record decision

• Without code or seed

I want to review the access decision without keys or codes in the log.

Connections

• Request → Caller & account
• Caller & account → Policy & approval
• Policy & approval → Permitted
• Policy & approval → Stop
• Permitted → Record decision
• Stop → Record decision

How to read this

1. The agent describes a specific requested operation.
2. The route must establish the caller and exact account before granting access.
3. Policy determines scope, expiry and any required approval.
4. Only the permitted operation may follow, without giving the account secret to the model. Execution must stop when the account is ambiguous or permission is insufficient.
5. I want to review the access decision without keys or codes in the log.