# Agents and automation

One gives humans, scripts, CI, operators, and AI agents different interfaces to
the same typed operations. No interface gains a hidden control plane.

## Fix context before capability

Every automation session starts with an exact workspace or subject scope,
selected roots, policy, identity, tool set, resource budget, and provider
bindings. Context construction is inspectable and bounded.

Reading a file, receiving a prompt, or seeing a credential reference does not
grant authority to disclose, mutate, execute, deploy, or use the referenced
secret. Each action is authorized independently.

## Use operations, not command text

Automation consumes versioned requests and results for source reads and
transactions, search, check, test, invoke, plan, Build, apply, cancellation,
and inspection. A terminal command may project the same operation for a person,
but machine callers do not scrape human output or acquire a shell bypass.

The protocol preserves owner-qualified identities, typed failures, progress,
approval suspension, resumability, and evidence links.

## Separate proposal from effect

An agent can draft source patches, explain plans, compare providers, propose an
operation, or prepare an approval request. The owning parser and systems still
validate the exact result. A write uses a revision-checked source transaction.
An effect uses a reviewed plan and fresh grant.

Approvals display the actual action, subject, scope, data disclosure, provider,
cost, expiry, and blast radius. Approval of a summary does not authorize later
different arguments.

## Make autonomy bounded and resumable

Long work retains deterministic agent and tool events, resource consumption,
child tasks, approvals, cancellation, and terminal disposition. A suspended
task resumes from exact retained state rather than reconstructing authority
from conversation text.

Delegated child work receives an attenuated subset of workspace, tools,
budgets, and grants. It cannot further delegate unless explicitly permitted.

## Govern models as providers

Model selection is independent from the agent operation contract. A model
provider profile states data handling, retention, region, price, context and
output limits, tool-call behavior, identity, availability, and evidence.

Sensitive prompts can require local inference, redaction, confidential
execution, or explicit disclosure approval. Model quality observations inform
selection but never become authority.

## Example

An illustrative approval request binds the exact proposed effect:

```json
{
  "operation": "parcelhub.refunds#Approve@1",
  "subject": "refund/order-7391",
  "amount_minor": 4200,
  "expires_in": "5m"
}
```

See [authority and trust](/one/platform/authority) and
[product guarantees](/one/reference/guarantees), then follow the
[bounded agent recipe](/one/examples/agent).