Developers and agents · Planned
Default: nothing. Then exactly what you grant.
This is the design for how agents, programs and connectors will be bounded in Selfirm. It is not shipped. We publish it because the rules are settled and because they shape everything that is built before agents arrive.
What a grant contains
| Part | Meaning | Example |
|---|---|---|
| Scope | Which parties and which things | Company A’s accounts only |
| Actions | What may be done with them | Read; draft a reply |
| Budget | How much it may spend on its own running | A monthly cap on model usage |
| Period | When the grant ends | 30 days |
The rules
- An agent starts with no permissions. They are granted per task.
- Every tool call is checked by a separate, deterministic permission service. A model’s reasoning in natural language is never authorisation.
- Content that came in from outside is untrusted and cannot change permissions through text.
- Financial write operations are switched off at the tool interface itself, not merely discouraged in a prompt.
- No agent writes to the database. It submits a proposal through a controlled interface, and the application records it.
- Rules and custom code produce data only. Acting on the outside world goes through an executor and its grant.
The full matrix
| Operation | Owner | AI agent | Data connector |
|---|---|---|---|
| View things and balances in scope | Allowed | Within grant | Within grant |
| Produce analysis or draft tasks | Allowed | Allowed | Not allowed |
| Change the record | Allowed, audited | Draft for review only | Not allowed |
| Draft outward content | Allowed | Within grant | Not allowed |
| Send outward content | Allowed | Later; approval required | Not allowed |
| Suggest a transfer | Allowed | Draft only | Not allowed |
| Submit a securities trade | Not offered | Forbidden | Forbidden |
| Sign an on-chain transaction | In your own wallet | Forbidden | Forbidden |
| Change permission policy | After strong sign-in | Forbidden | Forbidden |
The life of a request
- 01
Propose
The agent states what it wants to read or do.
- 02
Check
The permission service compares it with the grant.
- 03
Decide
Allowed, turned into a matter for approval, or refused.
- 04
Record
The request and its outcome are kept either way.
Common questions
Whose credentials does an approved outward action use?
That is still open. Selfirm does not hold credentials to outside accounts, so how an approved post or reply is actually sent is one of the questions we are working through.
Building agents for your own company?
Join the waitlist and tell us which boundary you miss most today.