The five layers
Identity
People, service accounts, and agents are all first-class principals in a workspace. Nothing acts
anonymously.
Permissions
Roles and grants decide which capabilities an identity holds, and on which resources. Default
deny, additive grants.
Standards
Every agent is created against your organization’s standards — ownership, budget, judges,
guardrails — with waivers shown rather than hidden.
Runtime gates
Guardrails inspect a tool call, a model request, and what comes back, and can refuse or redact
before the action lands.
Approvals
A consequential action can wait for a person, with the evidence needed to decide.
The record
Every governed change and every sensitive read is written to an append-only audit log.
The principle underneath
An agent is governed the same way a person is, and by the same machinery. An agent has its own identity, holds its own roles, and is refused by the same enforcement that refuses a human — which is what makes “what can this agent do?” a question with an answer rather than an assumption. Two properties follow from that, and they are worth stating because they are what makes the model trustworthy:- Enforcement is not inside the agent. An agent cannot decide to skip a check, because the checks do not run in the agent’s process. They run at the boundary the agent’s traffic has to cross.
- The identity is the credential. A worker’s token resolves the agent and its workspace on its own. An agent cannot present someone else’s name and be believed.
What each layer stops
Reading order
Start with Signing in and Roles & permissions — they establish the vocabulary every other page uses. Then read Standards & Guardrails for the controls that act at runtime, and the Architecture considerations section for how workspaces, secrets, data, and network traffic are isolated underneath.Next steps
Agent identity
How an agent authenticates and what it is permitted to do.
Access explorer
Check what an identity can actually do, before you change anything.
Agent isolation & tenancy
The workspace boundary, and how it is kept.
Secrets & credential handling
How a secret reaches a run without being exposed.