The action must be allowed, not merely suggested.
Authority belongs to the operating environment
A model’s proposal describes what an agent wants to do. Whether it may do it depends on the current identity, organizational policy, delegated scope, target and operation. Prompt wording and interface presentation do not replace that decision.
Connecting a system makes its supported functionality available to configure. It does not authorize every agent to use every account or operation. Reading information, preparing a change and applying that change can have different permissions even when they concern the same system.
Explore the Governed Autonomy research.
Allowed work can proceed within its scope
An allowed action fits existing authorization and can proceed without asking the person to approve it again. The scope still matters: a permission for one resource, operation or organization is not a general permission over everything the agent can describe.
This is how useful autonomous work and control coexist. A routine permitted read need not interrupt the person, while a materially different change can require review or remain unavailable. Repeating a request does not widen the grant or turn an earlier refusal into permission.
Review is a decision about concrete work
When policy requires approval, the agent prepares the proposed action for the appropriate decision. The reviewer needs to understand what is changing, where, and why. An unrelated earlier approval is not permission for a different destination or effect.
Approval allows the reviewed work to proceed within its applicable conditions; it is not proof that the operation succeeded. The system’s response still needs to be checked. If the action changes materially before execution, the earlier decision must not be treated as a blank authorization.
A prohibition is not a request for another click
An organization can prohibit an operation or make a system unavailable to a participant. A model cannot overturn that policy by describing the operation as necessary, and a visitor’s public-site instruction does not create organizational authority.
The useful response to a prohibition is to explain the permitted boundary and continue whatever authorized work remains. An alternative must stay within the same policy; switching tools, accounts or wording must not become a hidden way to perform the refused effect.
Delegation can end or change
Delegated scope is associated with the work and the responsible identity. Access can expire or be revoked. Follow-up must use current authority, not assume that a previous successful turn grants permanent access.
Stopping work, closing a window and revoking access are distinct decisions. Cancellation can prevent later work but does not undo a change already made in an external system. Recovery must account for what actually happened, including an outcome that cannot yet be confirmed.
Keep the request, decision and outcome connected
Reviewable records help a person understand the operation requested, the authority used, the decision and the observed result. A prepared draft, an attempted call and a confirmed change are separate outcomes. When evidence is unavailable or incomplete, the product should say so.
Security and Trust define the current public commitments around controls and records. Privacy, Terms and the DPA govern their respective subjects. This reference explains the operating model and does not add a certification, universal evidence guarantee or new contractual promise.
Public Home has a narrower scope
Website Home can work with its admitted public knowledge, example sources and information the visitor provides. It cannot acquire access to the visitor’s desktop, files or signed-in applications through conversation. The fictional demonstration’s allowed actions do not represent authority over a real business.
Installed Cuttlefish uses actual accounts, connections and organizational permissions. Enterprise evaluation should check representative allowed, review-required and refused operations with the intended identities and systems rather than infer that behavior from a public demo.