Control agent actions

Give each agent an owner and explicit limits. Before a sensitive tool call, the agent’s current permission decides whether the call runs, waits for approval, or stops.

Agent          research-agent
Action         Send email
Authority      Draft  ✓
               Send   ✕
Decision       Blocked

What you can limit

Limit	What happens
Allowed actions	Only the listed actions can run.
Denied actions	Always blocked. A denial wins over an allowance.
Human approval	Irreversible actions wait until a person approves.
Spend cap	Caps how much the agent can pay.
Expiry	Permission ends on the date you set.
Revoke	Permission ends the moment you revoke it.

A missing, expired, or revoked permission fails closed.

Set it up

Give the agent limits

Connect Proofable, then ask your assistant:

Create or import an agent named research-agent. Allow draft_email, deny send_email, and require human approval for irreversible actions.

Load its permission where the tool runs

npx -y @proofable/sdk mount research-agent --apply cursor

This writes the agent’s current permission to .proofable/mount.json. Use claude or codex in place of cursor for those hosts. If the CLI asks for a credential, run npx -y @proofable/sdk auth --oauth first.

Check before the tool call

import fs from 'node:fs';
import { evaluateRuntimeAction } from '@proofable/sdk/runtime-mount';

const bundle = JSON.parse(fs.readFileSync('.proofable/mount.json', 'utf8'));
const decision = evaluateRuntimeAction(bundle, 'send_email', { irreversible: true });

if (!decision.allowed) {
  throw new Error(`${decision.code}: ${decision.message}`); // ACTION_DENIED
}

Guard an agent action walks through the same flow with every decision code.

Where the check runs

Where the agent runs	What enforces the decision
Chat and jobs on Proofable	Proofable checks permissions, tool access, and proofs before each action.
Cursor, Claude Code, and Codex	The host loads the agent’s rules. Start a new session after you mount.
Your own workers and backends	Your code calls `evaluateRuntimeAction` and stops when `allowed` is `false`.

Proofable supplies the decision. The system that owns the tool call must honor it.

Built-in guardrails

Connected apps. Only the capabilities you enable can run. Sends, creates, and deletes still pass through agent permissions. Connections
Secrets. Stored encrypted and never returned in plaintext through MCP. Connected tools run without handing credentials to the model. Security
Payments. Set maxSpend with the payments:x402 scope. Your application checks the cap before it signs each payment. Pay per call
Jobs. A run that needs approval waits for you. Approve to continue, or deny to stop it. Jobs

Guard an agent action

Run one allow or deny decision end to end.

Agent permissions

Every permission field, with examples.

Prove what happened

Keep a record of each decision and result.

Agents

Owners, limits, and proof history for every agent.

Overview

Common use cases

Products

Guides

What you can limit

Set it up

Where the check runs

Built-in guardrails

Next

Guard an agent action

Agent permissions

Prove what happened

Agents

​What you can limit

​Set it up

​Where the check runs

​Built-in guardrails

​Next

Guard an agent action

Agent permissions

Prove what happened

Agents

What you can limit

Set it up

Where the check runs

Built-in guardrails

Next