Why we treat the model as an untrusted planner

An agent platform has one question at its centre, and everything else is downstream of the answer: **what happens between the model saying "call delete_customer" and that call actually running?**

Our answer is that the model is a planner, and an untrusted one.

A suggestion is not an instruction

A language model can emit any tool name with any arguments. It can be talked into it by a hostile document it was asked to summarise. It can arrive there on its own, confidently and wrongly. Neither case is unusual enough to design around as an exception.

So a proposed call is treated as what it is: a request from an untrusted source. Before anything happens, the platform verifies — independently, without consulting the model again — that:

• the tool exists, and this agent is allowed to use it
• your workspace owns the underlying connection
• the acting user holds the required permission
• the arguments validate against the tool's own input schema
• policy permits this operation at this risk level
• a human has approved, when approval is required

Why the prompt is not a security control

We write a careful system prompt. It makes the model behave better, and it makes its answers more useful. It is not what stops a deletion.

Telling a model "never delete anything" is theatre when the deletion is blocked anyway. What genuinely helps is telling it *when a call will pause for a human*, because a model that knows this tends to confirm intent first — which is exactly the behaviour you want.

An approval authorises one call

When a destructive operation pauses, the reviewer sees the tool and the exact arguments. Approving it does not unlock the tool, or the agent, or the rest of the conversation. It authorises **that call, with those arguments**, once.

The binding is a fingerprint of the arguments taken at the moment the question was asked. If the agent re-plans and produces something slightly different, the approval no longer matches, and the run stops again.

That distinction is the whole point. "A human approved something like this" is not a control. "A human approved exactly this" is.

Credentials never enter the conversation

The model sees tool names and argument schemas. It never sees the credential that reaches your system — not in a prompt, not in a response, not in a log line. Secrets are decrypted by the connector at the moment of the call and held only for its duration.

This is not a matter of trusting one AI provider more than another. It is that there is no version of "your database password went to a third party" that we are comfortable with.