Separating the agent's authority from the person's

A subset, not a careful equal#

There are two ways to stop software doing something dangerous. Teach it not to, or give it no way. The first depends on a model behaving under pressure from text a stranger wrote; the second is a property of the tool set, which is readable, testable and does not have an off day.

The read-only half of the tool set is deliberately large — find_anything, customer_360, recall, list_threads, data_query, search_knowledge and the rest — because the useful thing an assistant does most often is find and explain, and reading widely is cheap to allow when writing is narrow.

Three places the separation earns its keep#

1. Commercial terms. safe_sales.py is the rule that Connect does not invent them: a price, an SLA or a warranty Knowledge does not support is refused and escalated to a person.

   Result The refusal is the correct behaviour rather than a gap. A quoted number a business did not agree to is a commitment somebody has to honour or retract, and both are worse than a pause.

2. Compliance. Suppression, unsubscribe, complaints and do-not-contact are checked in one place before any outreach, and the Assistant cannot clear a do-not-contact entry.

   Result The one action that would convert a compliance record into a sent message is absent, so the check cannot be undone by the thing it constrains.

3. Identity. duplicates proposes merges and merge_people is a human decision, preserving identities, stages, follow-ups, deals, demos, cases and onboarding from both sides.

   Result A merge is close to irreversible and it changes what every future conversation is attached to. A proposal costs a person ten seconds; an incorrect merge costs an afternoon of untangling.

Why this is easier to reason about than restraint#

An absent capability produces the same answer under every prompt, in every language, on a bad day and at three in the morning. A restrained capability produces the same answer until something in the input is unusual enough. Reviewing the first is reading a list; reviewing the second is a research programme with no end state.

The trail records the difference. audit.py writes what was decided, by what, under which rule, and what happened — refusals included, because a refusal is a decision. So a separation that is working looks like something in the record rather than like nothing at all, and "the Assistant declined and escalated" is a sentence with a row behind it.

Where the separation is thinner than it looks#

• On the realtime voice path the rule lives in the instructions. There is no tool call to withhold when the model speaks a sentence, so a breach is detected rather than prevented: price_spoken counts the lines the voice priced, through the same expression the carrier path checks each sentence with, so the two paths agree on what a price is.
• A person's own authority is not narrowed by any of this. These rules constrain the agent. Somebody with permission to send on a channel can send, and the record names them.
• The grid is not a second authority. #/data looks like a spreadsheet over 13 sheets, and every change still goes through the service that owns the record, so bulk editing does not become a wider set of rights than the screens have.
• Supervisor guidance is separated in the other direction. An instruction a colleague types during a live call goes into the system prompt and nowhere else — never into the spoken reply, never into call_turns, never onto the wire.

Questions#

Related#

• Connect Assistant
• Why an agent's tools should call domain services
• Human approval without blocking low-risk work
• Why a sales agent should refuse to answer
• Prompt injection arrives as ordinary business mail
• What Connect may do