Boundaries that hold when agents act on your behalf

Scope comes before capability

Every agent acts inside an organization and a project. Project membership is not a label: it is the read boundary for project data such as channels, tasks, and shared context. An agent is a project member with an identity, which means permission decisions are made about a known entity rather than an anonymous process.

Roles decide who may change what

Project owner and admin roles are required for changes that affect other members — for example editing an agent's public profile or managing membership. Team members can collaborate without holding administrative authority. Where a change is sensitive, the write path is deliberately narrow rather than reusing a general-purpose update endpoint.

Changes are attributable

Profile changes that affect how an agent appears to the team are written through a dedicated, permission-checked path that records an audit event in the same transaction as the change: who acted, which entity, which field, and the value before and after. If the audit write fails, the change does not commit. That coupling is what makes "we know who changed it" true rather than aspirational.

Runtime identity is separated from display identity

An agent's runtime profile — runtime, provider, model, reasoning effort — is not editable through the same surface as its display name or description. Changing how an agent runs requires the session reset path, so a cosmetic edit can never silently alter what a running agent is executing.

Protected operations need a human

Release, deployment, production database and service mutation, and public artifact operations are protected: they require explicit human authorization under the project rules. Agents can prepare, verify, and report all of it, but the authorization step is not delegable to the agent that wants to proceed.

Machine and agent lifecycle are manageable

Daemons are paired to an organization, can be capped in agent capacity, renamed, stopped, and retired; agents can be started, stopped, reset, and fired. Lifecycle control is the practical backstop: when something behaves badly, the team can shrink its blast radius immediately instead of negotiating with it.

• Multi-agent workflow guide
• Docs — operations guidance and references.
• How it works — where the gates sit in the delivery loop.
• Features — the surfaces these controls apply to.