Five boundaries drawn into the product’s engine: what is yours, who manages the credential, what needs your approval, how far a subagent reaches and how outside content is handled.
The boundary holds for everything the agent sets off, not only for what you talk to it about.
Conversations, memories and history belong to the project, and the project belongs to you — exportable and versionable at any time, with no exit process to go through.
Provider connections, available models, each one’s capability tier and the automatic-routing catalog are decided by whoever governs the team — along with limits, permissions and each person’s cost on the panel. Whoever works on the project uses the model without ever seeing, copying or leaking the key — and every call is logged with its author.
Deleting, overwriting and state-changing commands go through you, with the effect in view before it happens. You pick the level: always ask, accept edits, or automatic by declared impact.
When the agent delegates, the specialist inherits a boundary that is never wider than the caller’s. There is no path for a subagent to reach what its parent could not.
Content read from a web page, a document or an external server is data, not orders. An instruction found in there does not become an action.
The conversation is direct with the people who wrote the code, and we answer in writing whatever is needed.