13.01 · Concept
Scoping what it is allowed to do
Write down the agent's remit and enforce it in code, not in the prompt.
An agent remit is a code-enforced permission boundary: the model may suggest work, but deterministic checks decide what can actually run. Define the resources, operations, identities, environments and approval paths outside the prompt, then make every external tool call pass through that policy before it changes anything.
What this lesson answers
- how to define an agent remit
- why prompts cannot enforce agent permissions
- how to restrict agent tool calls in code
Notes
An agent’s remit is the boundary between “things this system may do” and “things it must refuse, ask about, or escalate.” For a shipping agent, that remit should be written like an engineering contract: which resources it can read, which actions it can take, which environments it can affect, which users it can act for, and which decisions require human approval. The important shift is to treat the model as an untrusted planner, not as the authority that decides its own permissions.
The concrete mental model is a service account with a policy layer. The model can propose: “create a ticket,”…
Common questions
- What should an agent remit include?
- It should state what the agent may inspect, what operations it may request, which runtime contexts it may touch, whose authority it can act under, and when a person must approve the next step. Write it like an engineering policy, not like advice to the model.
- Why is a prompt not enough to scope an agent?
- A prompt is part of the model input, not a security control. It can be misread, diluted by long context, contradicted by retrieved material, or followed incorrectly. The model should be treated as a planner whose proposed actions are checked by code before anything external happens.
- How do you enforce an agent's scope in practice?
- Put every capability behind a validation layer. Use explicit allow rules, safe defaults, per-user checks, typed inputs, environment separation, approval gates, logs, and tests for denied actions. The agent can ask or escalate when blocked, but it should not be able to bypass the control path.
Short definition: what is Scoping what it is allowed to do?