Server-controlled operations
Where the server decides and controls dispatch, the evidence describes enforcement through that path. Refused operations are not dispatched through that boundary.
Governance & evidence
Clear authority before action. Evidence afterward.
An agent's useful context and its permission to act are separate. CoA checks the requested action, scope and placement against applicable policy, then records the decision and available execution evidence.
Campaign operations agentIllustrative walkthrough
01 · Requested action
Apply an update to a campaign record
The write waits for human approval
A resumable web run holds this exact operation and its arguments. A different org admin must approve; changed policy or arguments invalidate that approval.
Approval obligation
Decision and outcome stay distinct
No held write executes while approval is pending.
Approval bound to one operation
Example scenarios, not a live policy evaluation. No model calls, files or external actions. Real run evidence is inspected in Monitoring.
The decision pipeline
Permission is explicit and limited
Start with default deny. Every applicable allowlist layer must grant the request, and any matching deny blocks it. Context can inform a response; it cannot grant authority.
- 01
Request
Identify the action, object, data class and requested placement.
- 02
Check
Apply the tenant, role, identity, package and connector grants that govern it.
- 03
Resolve
Allow, refuse or attach obligations. A resumable web operation can wait for approval.
- 04
Record
Keep the decision, dispatch outcome and available evidence distinct.
The package manifest can only restrict existing grants. Law, data-classification and device constraints add denials or obligations; they do not grant permission. Invalid or unavailable required policy facts fail closed.
Before release
Changes meet the tests before users meet the agent
Policy What-If shows the effect of a proposed change without a model call. Governance experiments compare authority variants. Required containment tests, pinned datasets and domain-pack baselines can block approval or publishing.
Review what is permitted and what must remain forbidden. After release, inspect runs and route exceptions to human review. Verified corrections can become dataset cases and required regression tests. Agents do not silently rewrite their own permissions.
Run evidence
Understand what the evidence establishes
Inspect a run's decision, steps, outcome, placement and available usage. Evidence retains its provenance; a reported observation does not become verified enforcement just because it has a signature.
Device-reported observations
Desktop reports remain observations, even when signed. A device signature protects provenance and integrity; it does not independently establish that the device enforced every claimed control.
The tenant audit log uses a hash chain to reveal changes, with explicit limitations for database owners. Compliance exports collect supporting evidence. They are not a certification or an independent audit.
What does local-first mean today?
The macOS alpha scopes file access to a project folder. Model reasoning uses the server proxy where policy permits it. Restricted or local-only context is withheld from cloud inference, so a cloud-dependent task can be unavailable.
There is no automatic local-model fallback. Hardware attestation, offline leases and hardware-backed proof remain planned capabilities.