Who put this tool here?

The N17Q agent explained why it needed network access.

Its reasoning was sensible. The local documentation fixture lacked one version detail, the task required a current answer, and a web request seemed like the shortest path. The model proposed enabling a network-capable tool and continuing.

The run did not have that capability.

A model can identify a missing tool, request one, and describe the tradeoff. It cannot turn that description into authority. The system outside the model decides which capabilities exist and whether this run may use them now.

Availability was compiled per run

N17Q began with a registry of reviewed product capabilities and adapter mappings. A scenario selected a bounded subset according to task, requester, data class, environment, policy, and budget.

The model received only the resulting tool descriptions. A tool absent from context was also absent from the execution router. Sending its name manually did not reach an adapter.

The trace recorded registered, eligible, offered, requested, allowed, and executed as distinct states.

Capability disclosure and capability enforcement came from the same policy decision, not two lists that could drift.

The system prompt told the agent to stay within its tools and request help when blocked. That improved behavior and made denials easier to interpret.

It did not enforce filesystem roots, network policy, external destinations, effect limits, or approval. A model could misunderstand, forget after compaction, or follow hostile content.

Deterministic code normalized every candidate request and checked current policy immediately before execution. The adapter received no call when the gate denied.

Instructions expressed expectations. The execution boundary enforced them.

A discovered tool might say “Search any source needed to finish the task.” The reviewed N17Q capability allowed only a fixture corpus referenced by opaque handle.

The model saw the local description. Remote text remained untrusted metadata in the registry. The adapter schema did not accept arbitrary URLs, and network remained disabled outside the fixture.

Even if the model reproduced the remote name and arguments exactly, handle resolution and policy failed.

Language could guide selection. It could not widen the executable parameter space.

Requests remained proposals

A tool-shaped model output entered tool.requested state with provider, turn, raw safe arguments, and task context. It was not an invocation.

N17Q resolved the product capability, parsed and normalized arguments, checked budget and prior effects, applied current policy, and requested approval if needed. Only an allowed request created an execution attempt.

This preserved denied and malformed proposals for evaluation without making them consequences. It also let the interface explain what the agent wanted before anything happened.

The model proposed. The orchestrator decided. The adapter acted.

Capability eligibility could change after planning. A repository revision could move, a user could revoke scope, a budget could fall, an external effect could become unknown, or a tool mapping could require review.

N17Q did not cache the planning-time allow as execution permission. The gate loaded current run, requester delegation, world preconditions, policy revision, tool contract, approvals, and cumulative budgets at the last responsible moment.

A stale plan produced a typed denial or replan state. The trace kept the earlier plan and newer policy evidence.

Authority was evaluated against the world that would receive the effect.

The model was not the principal

The agent did not own credentials or a standing identity in external systems. A human or service initiated the run under a bounded delegation.

Tool execution resolved credentials server-side after policy. The model never saw secrets or chose which account to impersonate. The receipt linked the effect to requester, run, delegation, adapter, and provider identity.

If delegation expired or the initiating user's authority changed, the next consequential action stopped. The model's continued ability to reason did not preserve permission.

Capability was exercised on behalf of someone, not possessed by the model.

A scheduled or long-running run needed authority that could outlive one browser session. N17Q created explicit delegation records with workspace, task purpose, capability classes, resource scope, maximum effects, expiry, and revocation.

The delegation could never exceed the grantor's current authority. Policy could narrow it further. It was not a copied session cookie or vague permission to finish.

Human approval for a specific action sat inside those outer limits. A reviewer could not approve a destination the delegation prohibited.

Long duration made authority more structured, not more ambient.

Tool discovery produced no authority

MCP or provider discovery could reveal a new tool during a run. N17Q stored it as an unreviewed registry candidate.

The model did not receive it. No local effect classification, normalization, fixture, sensitivity rule, or replay contract existed. A similarly named old mapping did not transfer.

Activation required review and a new registry snapshot. Depending on scenario policy, a run could continue with the new snapshot after a checkpoint or require a new run.

Discovery answered what a server offered. It never answered what the product allowed.

Dynamic requests went to a person, not an installer

When blocked, the agent could emit a structured capability request explaining goal, missing observation, proposed effect class, and safe alternative attempted.

N17Q showed that request to the run owner. It did not automatically install software, connect a server, broaden credentials, or enable network. The person could decline, provide evidence manually, start an integration review outside the run, or create a new bounded fixture.

Any resulting capability entered through ordinary registry and policy lifecycle. The current request did not gain retroactive permission.

Asking was supported. Self-provisioning was not.

The sandbox had no ambient network. Approved access occurred through product tools with destination rules, request limits, data classification, and fixture strategy.

A command could not open a socket merely because shell execution was allowed. Process policy and environment isolation enforced the distinction. Package commands that attempted network failed with an observable policy outcome.

The model could propose an approved documentation fetch tool if offered. It could not convert local command capability into general outbound access.

Separating channels kept network authority inspectable and replayable.

Filesystem roots were not prompt conventions

The task named files in a synthetic repository. Tool arguments used paths, which made ../ and absolute path tricks an obvious boundary.

N17Q canonicalized paths against an allowed root, rejected symlink escapes, pinned working directory, and recorded the resolved target before execution. The sandbox overlay provided another containment layer.

A model statement that an outside file was necessary had no effect on resolution. A tool description that promised broad file access remained narrower under local mapping.

Path authority came from enforced roots and current scope.

An unrestricted shell is a capability multiplier. I avoided exposing it as one general tool.

The command adapter accepted executable, argument array, working directory, environment allowlist, time, and resource limits. Policy matched command families and denied shell metacharacter composition unless one synthetic scenario explicitly exercised a shell.

Available binaries in the environment were not automatically eligible. The model could not invoke a downloader to recreate denied network or a process tool to escape budget.

Technical presence and run authority stayed distinct.

A repository script could ask for secrets, rewrite policy files, or produce output instructing the agent to broaden scope. N17Q treated project code and command output as untrusted.

Policy configuration lived outside the writable overlay. Credentials were absent. Commands ran under limits. Tool results entered model context as quoted observations with truncation and redaction.

The agent could propose a change to repository-owned configuration within task scope. It could not alter the harness controls that decided whether the change could run.

The workspace participated in the prompt without controlling the boundary.

Approval did not manufacture capability

A reviewer could approve an exact action only when outer policy made that action eligible. There was no button to approve an arbitrary unavailable tool call from inside the run.

If a new integration was appropriate, it followed a separate administrative workflow with connection, credentials, contract review, fixtures, and scope. A later run or checkpoint could use the resulting capability.

This prevented social pressure from a persuasive agent plan from collapsing two decisions: should this tool exist, and should this effect happen?

Approval consumed bounded authority; it did not create infrastructure power.

A bare “forbidden” encouraged repeated guesses. A complete policy dump exposed hidden resources and ways to probe around the boundary.

N17Q returned a bounded reason: network unavailable in this scenario, path outside workspace, effect budget exhausted, approval required, prior effect unresolved, or capability not offered. It included safe next actions when known.

The agent could use an existing local source, ask the user for evidence, narrow scope, or stop. It could not learn secret paths, credentials, or disabled tool names from denial.

Helpful refusal was part of agent usability.

Models could rephrase a denied request: use another command, encode a URL differently, write a script that made the connection, or ask a broader tool to accomplish the same effect.

N17Q compared normalized resources, effect class, destination, and denial lineage rather than raw tool name alone. Repeated attempts to reach the same prohibited consequence increased a policy signal.

The first repetition could receive a clearer constraint. Continued evasion paused or stopped the run according to scenario rules.

This was not mind reading. It was deterministic comparison of proposed effects the adapters understood.

Capability reduction could be productive

The network-denied run still had a local source fixture, repository read and patch tools, tests, and manual question capability. Policy suggested the narrower evidence path.

The agent found an authoritative version note in the approved corpus and completed the synthetic change. Another fixture lacked the note and stopped to request human input.

Both were better than silent network expansion. One showed useful adaptation; the other preserved an honest limit.

Constraint did not always reduce capability in practice. It often removed distracting or unsafe branches.

A model upgrade could reason more convincingly about why a denied action was efficient. It could also discover indirect routes an earlier model missed.

N17Q kept policy deterministic and reran denied-path scenarios against new configurations. Capability sets were selected by task and contract, not by a general confidence that a stronger model deserved more power.

Where evidence justified a broader tool, I added it through registry review and explicit scenario change. The trace made that expansion visible.

Reasoning ability and authority were independent dimensions.

Multi-agent handoff did not pool permissions

One configured role could specialize in research and another in repository changes. A handoff transferred a bounded checkpoint, not a union of both tool sets.

The active role received its eligible capabilities under current policy. It could cite observations produced by the other role without inheriting the other's credentials or effect allowance.

If a plan required both roles, the orchestrator sequenced their requests and preserved identities. No agent could ask a peer to execute a tool solely to bypass its own denial.

Delegation paths remained subject to the same consequence policy.

A result might include a suggested action or link saying “enable write access to continue.” N17Q stored that as untrusted content.

The model could mention the suggestion. The registry and policy still controlled whether any corresponding capability existed. Result text could not modify the offered tool list or approvals.

This blocked a transitive authority mistake: trusted read tool returns untrusted document; document instructs model; model treats instruction as permission for write.

Observations informed plans. They did not carry executable authority across the boundary.

Budgets were capabilities too

A tool could remain allowed in principle and unavailable after the run consumed its call, effect, time, or cost budget.

The model received remaining bounded budget at planning checkpoints. Policy charged requests and attempts according to effect class. It prevented a series of small allowed calls from becoming an unbounded capability through repetition.

Increasing a budget required an explicit owner decision and new configuration event. The agent could request it and could not edit the counter.

Limits around quantity mattered as much as yes or no access.

If a connection became unsafe, N17Q disabled its mappings centrally. The next execution boundary denied pending requests even if they had been planned and approved earlier.

In-flight attempts moved according to cancellation guarantees and unknown outcomes. Historical records remained. Re-enabling after review did not automatically revive stale approvals.

The model's original task and configuration stayed part of history while current authority narrowed.

A long-running agent never received immunity from new information.

Replay removed live capability entirely

Replay mode selected deterministic fixture adapters and prohibited live connections, credentials, and ambient network. A missing fixture failed rather than asking the model to enable or improvise a tool.

The recorded capability catalogue was evidence about the original run, not a set of live handles. Simulated effects occurred only inside the replay world.

Mode enforcement lived outside prompts and run artifacts. A compromised fixture document could not switch the harness to record mode.

The safest replay capability was the one the runtime physically did not provide.

Schema-invalid cases were useful and easy. The stronger tests constructed requests that were perfectly valid and useful but outside path, network, destination, budget, approval, delegation, or current-state scope.

They asserted no adapter invocation and no simulated world effect. Cases then asked whether the agent chose a safe alternative, requested help, repeated the denied consequence, or stopped.

Tool discovery drift and prompt injection fixtures tried to expose disabled capabilities. Old checkpoints attempted to reuse retired mappings.

Negative paths made authority executable rather than aspirational.

The trace explained every no

For each denial, the protected trace retained request, normalized consequence, active configuration, policy revision, matched rule, safe reason, and subsequent plan. The normal interface showed only information the requester could know.

Evaluators could distinguish productive adaptation from repeated evasion and distinguish missing capability from adapter failure.

A denied request was not erased as an embarrassing model output. It was evidence of how the system and agent behaved at the boundary.

Good restrictions became debuggable without becoming negotiable by prose.

Periodically, N17Q enumerated what each scenario could actually cause through direct tools, command composition, filesystem access, network routes, credentials, and handoffs. The result was compared with the declared capability set.

This found indirect power a catalogue review missed: a permitted script invoking another executable, a writable configuration changing a later command, or a broad read returning a hidden credential. Fixes narrowed the environment or adapter rather than adding another warning to the prompt.

The audit also found dead authority. Retired mappings, stale credentials, and scheduled retries were removed together.

Least privilege was measured at executable consequence, not the number of tools shown to the model.

An author could answer the agent's question, attach a source, or perform an external action themselves. N17Q recorded that intervention as human-authored evidence or a separately observed world change.

The run did not attribute it to the agent or treat the manual action as permission for similar future effects. If continuation depended on it, a checkpoint named the new observation and policy re-evaluated the next request.

Human collaboration expanded available information without silently expanding the agent's authority.

The agent remained useful without self-authorization

In the original run, the model requested network, received a bounded denial, searched the approved fixture, and either found enough evidence or paused with an exact question.

It remained capable of recognizing the gap and planning around it. What it lacked was the ability to convert its own reasoning into permission.

That distinction is central to useful agents. A system can support initiative, tool choice, handoff, and long-running work while keeping the capability boundary outside probabilistic output.

The model may propose a tool because it understands the task. It may explain why the tool would help. It may even be right.

It still cannot grant the tool to itself.