Stop an agent from doing what you did not allow

Give each agent an owner and explicit limits. Before a sensitive tool call, the agent’s current permission decides whether the call runs, waits for approval, or stops.

Agent          draft-agent
Action         Send email
Authority      Draft  ✓
               Send   ✕
Decision       Blocked

What you can limit

Limit	What happens
Allowed actions	Only the listed actions can run.
Denied actions	Always blocked. A denial wins over an allowance.
Human approval	Irreversible actions wait until a person approves.
Spend cap	Caps how much the agent can pay.
Expiry	Permission ends on the date you set.
Revoke	Permission ends the moment you revoke it.

A missing, expired, or revoked permission grants nothing.

Set it up

Give the agent limits

Add Proofable, then ask your assistant:

Create or import an agent named draft-agent. Allow draft_email, deny send_email, and require human approval for irreversible actions.

Load its permission where the tool runs

npx -y @proofable/sdk mount draft-agent --apply cursor

This writes the agent’s current permission to .proofable/mount.json. For other hosts, replace cursor with claude, codex, hermes, openclaw, or opencode. If the CLI asks for a credential, run npx -y @proofable/sdk auth --oauth first.

Check before the tool call

import fs from 'node:fs';
import { evaluateRuntimeAction } from '@proofable/sdk/runtime-mount';

const bundle = JSON.parse(fs.readFileSync('.proofable/mount.json', 'utf8'));
const decision = evaluateRuntimeAction(bundle, 'send_email', { irreversible: true });

if (!decision.allowed) {
  throw new Error(`${decision.code}: ${decision.message}`); // ACTION_DENIED
}

Guard an agent action walks through the same flow with every decision code.

Where the check runs

Where the agent runs	What enforces the decision
Chat and jobs on Proofable	Proofable checks permissions, tool access, and proofs before each action.
Your tools	The host loads the agent’s rules. Start a new session after you mount.
Your own workers and backends	Your code calls `evaluateRuntimeAction` and stops when `allowed` is `false`.

The system that owns the tool call enforces the decision.

Built-in guardrails

Connected apps. Only the capabilities you enable can run. Sends, creates, and deletes still pass through agent permissions. Connections
Secrets. Stored encrypted and never returned in plaintext through MCP. Connected tools run without handing credentials to the model. Security
Payments. Allow make_payment with allowedPaymentTypes: ["x402"] and a maxSpend cap. Your application checks the cap before it signs each payment. Pay per call
Jobs. A run that needs approval waits for you. Approve to continue, or deny to stop it. Jobs

Agent permissions

Every permission field, with examples.

Prove what happened

Keep a record of each decision and result.

Agents

Owners, limits, and proof history for every agent.

Overview

Use cases

Compare

Reference

Legal

Guides

Stop an agent from doing what you did not allow

What you can limit

Set it up

Where the check runs

Built-in guardrails

Next

Agent permissions

Prove what happened

Agents

​What you can limit

​Set it up

​Where the check runs

​Built-in guardrails

​Next

Agent permissions

Prove what happened

Agents

What you can limit

Set it up

Where the check runs

Built-in guardrails

Next