A new hire gets a badge, a desk, a handbook, a manager and a personnel file. Agents got the first two. What an Intelligence Resources team will need in week one.

A control that can only say no gets bypassed by the people it was written for. The third answer, and the four properties that make it safe.

Agent identity decides who may reach what. The failures that matter happen after that yes: combinations, order, and time. Why identity and policy need each other.

Permissions say who may. Guardrails say what looks bad. Neither decides what your company allows. A ten-point checklist for the policy layer between assistants and MCP servers.

Using an LLM to police an LLM is non-deterministic, unauditable, and can be prompt-injected. Why the decision path has no model in it, with concrete examples.

Providers put group and role info in different claims. Hardcode "groups" and your SSO role mapping silently breaks for Cognito, Auth0, Google and more.

Prompt-injection exfiltration, tool poisoning and rug pulls, all blocked deterministically before the upstream is contacted. With repros you can run in a minute.

Scanners, guardrails, gateways, and where Aggrete's deterministic, stateful, document-driven policy is genuinely different. Including what it does not do.

The rules that should govern an assistant are already written down. Aggrete turns each clause into a deterministic, stateful rule, owned by whoever wrote it.

Stop sharing one master account. Each person's own credential and permissions are carried to the upstream, resolved per request through a hook you control.

Untrusted content can turn authorized tool calls into an exfiltration. Prompt filters miss it; a rule about the flow does not.

No single CRM read is sensitive. The volume is. An entity budget with per-user memory stops the mass export while normal selling passes.

A colleague's pay or leave balance is one prompt away. Self_comparison and min_group rules refuse it while your own record stays available.