One gives humans, scripts, CI, operators, and AI agents different interfaces to the same typed operations. No interface gains a hidden control plane.
Fix context before capability
Every automation session starts with an exact workspace or subject scope, selected roots, policy, identity, tool set, resource budget, and provider bindings. Context construction is inspectable and bounded.
Reading a file, receiving a prompt, or seeing a credential reference does not grant authority to disclose, mutate, execute, deploy, or use the referenced secret. Each action is authorized independently.
Use operations, not command text
Automation consumes versioned requests and results for source reads and transactions, search, check, test, invoke, plan, Build, apply, cancellation, and inspection. A terminal command may project the same operation for a person, but machine callers do not scrape human output or acquire a shell bypass.
The protocol preserves owner-qualified identities, typed failures, progress, approval suspension, resumability, and evidence links.
MCP and headless agent surfaces
one mcp and one agent expose the same governed tools and operations as the
CLI; an MCP client, headless runner, editor, or CI job receives no additional
control plane. Tool discovery is finite and snapshot-bound: the client sees the
tools, schemas, identity, budgets, and provider bindings fixed before it acts,
not an ambient registry it can widen at request time.
An MCP call is an operation request, not a shell bypass. A client cannot scrape human output, invent a missing tool, or infer an implementation language from body text. Diagnostic shapes and typed exit outcomes remain the shared diagnostics contract, and the One TUI is one more client over the same surface.
Separate proposal from effect
An agent can draft source patches, explain plans, compare providers, propose an operation, or prepare an approval request. The owning parser and systems still validate the exact result. A write uses a revision-checked source transaction. An effect uses a reviewed plan and fresh grant.
Approvals display the actual action, subject, scope, data disclosure, provider, cost, expiry, and blast radius. Approval of a summary does not authorize later different arguments.
Make autonomy bounded and resumable
Long work retains deterministic agent and tool events, resource consumption, child tasks, approvals, cancellation, and terminal disposition. A suspended task resumes from exact retained state rather than reconstructing authority from conversation text.
Delegated child work receives an attenuated subset of workspace, tools, budgets, and grants. It cannot further delegate unless explicitly permitted.
Budgets, approvals, and resumability
A session fixes a resource budget before the model receives context, and every tool call charges against it. Budget dimensions include elapsed time, input and output tokens, cost, context bytes, tool calls, child agents, network bytes, and effects. Exhaustion is a distinct disposition that can suspend for approval, hand off, or stop with recorded usage rather than silently truncating work.
Approval suspension retains the exact proposed action, subject, scope, disclosure, provider, cost, expiry, and blast radius. Resumption replays the retained agent, tool, approval, and resource events; it does not reconstruct authority from conversation text or repeat an already completed tool.
Govern models as providers
Model selection is independent from the agent operation contract. A model provider profile states data handling, retention, region, price, context and output limits, tool-call behavior, identity, availability, and evidence.
Sensitive prompts can require local inference, redaction, confidential execution, or explicit disclosure approval. Model quality observations inform selection but never become authority.
Inspecting an agent session
A session keeps deterministic agent and tool events, resource consumption, child tasks, approvals, cancellation, and its terminal disposition. Inspect the exact session or operation reference to answer what the agent saw, which tool it called, what it cost, and why it stopped. Model quality observations inform future selection but never become authority or a substitute for a fresh grant.
Example
An illustrative approval request binds the exact proposed effect:
{
"operation": "parcelhub.refunds#Approve@1",
"subject": "refund/order-7391",
"amount_minor": 4200,
"expires_in": "5m"
}Executable evidence
The checked-in support-triage project proves the bounded agent recipe: exact tool closure, a bounded tool and effect trace, deterministic inference, durable encrypted session selection, and idempotent resume.
cargo test -p support-triage-agent --all-targets --offlineThe authority and trust model explains why the prompt never grants authority, and workflows and agents is the design overview.
See authority and trust and product guarantees, then follow the bounded agent recipe.