What an agent principal cannot do

The problem

An agent planning a change spends its first turn discovering what it is not allowed to do, usually by attempting it. That is an expensive way to read a permission model, and the refusal arrives at the least convenient moment — halfway through a plan the agent has already committed to.

How the platform solves it

The limits are stated here, before planning, so a plan can be made inside them.

An agent principal acts inside exactly one tenant. There is no listing, reading or writing across tenants; a request that does not name the tenant is not a request for all of them. Anything that reaches another tenant’s records is refused.

Running is not building. The right to run a deployment does not carry the right to produce the image it runs. An agent that needs a new image needs the surface that builds them and a principal that holds it — the two roles are separate on purpose, and one principal holding both silently defeats the separation.

State the platform owns is not authorable. Identity, revision, status and timestamps are stamped by the platform. A description that tries to set them is refused rather than accepted and overwritten, so an agent never believes it set a value it did not.

Nothing may be written to the store directly. Every admission rule lives on the way in. A record written past them looks legitimate and was never checked, which is the one failure that leaves no evidence of itself.

Refusals are the interface, not an exception. Every refusal names the field, the value received, the accepted form, why it matters and a stable code to branch on. Branch on the code; never match on the message, which is written for a person and changes when the wording improves. The whole set is in rejections and alterations.

Not this

This page does not enumerate the tools or their arguments — those are the tool reference — and it does not describe how a principal is issued or rotated, which is an operational procedure.

Where to see it

• Every refusal code and what it means: rejections and alterations.
• What a description may contain: deployment manifest.
• The isolation boundary itself: tenancy and isolation.