Audit will ask who authorisedauthorized one transaction.
Which refund, at 14:02, on whose authority, under which rule. A service account can’t answer that. The caller’s own identity travels through the agent, gets checked on every tool call, and is written down with the decision.
Shared standards. Separate blast radius.
Each team gets a workspace: its own agents, its own access, its own network boundary and its own budget. What they share is how behaviourbehavior is defined and proven, not a namespace where one team’s bad afternoon reaches another’s customers.
Three ways an agent gets you into trouble.
Sensitive fields are stripped from a tool response before the model sees them, and what it may call at all is decided per call, against the identity of the person who asked.
A convincing instruction inside a document changes what the model wants to do. It doesn’t change the rule, so the call still fails, and the attempt is on the record.
Calls out, to another agent or a third-party tool, carry their own credentials and their own network policy, per workspace. One agent’s reach isn’t every agent’s.
Seven years of decisions, in a table you can already query.
Sessions age out of the fast store into columnar files in your own object storage, partitioned by date. The archive is a table your analysts can already query from Snowflake, BigQuery, Athena or DuckDB.
Retention is set per tier, so a week, a year and seven years are three decisions.
All three inside your boundary. The regulator’s question is a query you can run.
A prompt instruction is a request. A rule is a rule.
“Never refund more than £500” in a system prompt holds most of the time. Frequent enough to pass a demo, rare enough to reach an auditor.
It also works the other way round. A rule sees the arguments before the call leaves, so an agent that has been talked into sending a customer record to a summarisersummarizer, or a policy number to a webhook, doesn’t get to.
Show me who approved the agent that made that call.
The pack names who answers for the agent, what it’s for, and what it must not be used for. Every session it produces carries that block, hashed into the session’s composition digest. Change the approver afterwards and the digest moves.
The rule that refused a call is on the record the same way: the policy, the rule, and a digest of the rules as they stood when it fired. Rewrite the rule next month and last month’s decision still says what it was judged against.
The declaration is the pack’s own word, so nothing in it proves the approver approved anything; that provenance isn’t built yet. Article 50 of the EU AI Act has applied since 2 August 2026: declare the disclosure in the pack and the runtime delivers it and records that it did.
