Tool & permission boundaries for agents

The single most important idea in agent security: the model proposes, your code decides. A tool call emitted by a model is a proposal. If a confused or manipulated model asks to delete a file or send an email, the only thing that stops it is a gate outside the model — P56's policy thinking applied to tool calls.

Two rules carry most of the value: a least-privilege allowlist (a tool this agent doesn't have is refused outright) and human-in-the-loop for irreversible actions. This platform runs exactly these rules for its own agent-assisted authoring — scoped access, and confirmation before anything irreversible or outward-facing.