Parts VIII and XVI set the condition: an agent is useful when it can observe a defined input, use bounded tools, preserve state, produce an inspectable output, and stop or escalate appropriately. Useful without unexplained authority — that is the design target for your one agent or workflow.

The vocabulary of bounded agency

Use these words precisely; they become your review contract:

• Role — the job title in one line: "collect and structure filings," not "research assistant."
• Scope — the inputs it may read and the outputs it may produce. Everything else is out of scope.
• Memory / state — what it retains between steps: files, rows, conversation — and where that state lives.
• Loop — think → act → observe → decide → repeat, with a named exit: done, stuck, or escalate.
• Confidence — the agent's own signal about uncertainty, routed to a human — never silent self-approval.
• Gate — the checkpoint requiring human approval before a consequential step.
• Log — the append-only record: what it read, called, produced, and when.
• Exception — the defined failure modes and where each routes.
• Kill switch — the one control that pauses or revokes the agent immediately, with a named owner.

An agent missing any of these is not bounded; it is hopeful. Hopeful agents publish drafts, email customers, and charge cards at 2 a.m.

The action spectrum

Place every capability on this five-step spectrum and write the placement down:

1. Collect and prepare — read sources, structure evidence, draft. Safe default for v1. 2. Recommend — propose an interpretation or next step with reasons and sources attached. 3. Act with approval — execute only after a named human approves the specific proposal. 4. Bounded autonomous action — act alone within narrow pre-approved limits (e.g., re-fetch a failed filing twice, then stop). Logged, capped, reversible. 5. Never delegate — consequential judgment, external commitments, money, identity, publication. Human-owned, always.

Two running examples anchor the spectrum:

• ByeBuy Classroom: AI may organize a lesson draft and an artwork brief (collect, prepare, recommend). A human owns factual correctness, editorial quality, and the publish decision (never delegate). No auto-publish until twenty consecutive clean reviews — and even then, the gate stays.
• Sonariq / Research Desk: the agent may collect and structure source material with links (collect, prepare). Evidence judgment — "this filing supports that claim," "this peer comparison is fair" — and any consequential interpretation need an accountable human (recommend at most, act only with approval). Publishing, sending to clients, or trading on the output is never delegated.

The launcher follows the same shape: automation may acknowledge a booking request and prepare a slot proposal; confirming, rescheduling, or charging requires the human queue.

Exercise: create AGENT-BOUNDARIES.md

Create FINAL-PROJECT/AGENT-BOUNDARIES.md for your one agent or workflow:

# AGENT-BOUNDARIES — [Agent/workflow name], [date]

## Role (one line)
- …

## Inputs (may read)
- [source + permission: read-only …]

## Tools (bounded, named)
- [tool — allowed calls + rate/cost cap]

## Allowed outputs (spectrum position per output)
- [output — collect / recommend / approved-action / bounded-auto]

## Forbidden actions (never delegate)
- [publish / send / charge / delete / …]

## Memory/state
- [where state lives; what is retained vs. discarded]

## Loop + confidence
- [steps + exit conditions; how low confidence routes to human]

## Review trigger + gate owner
- [what requires approval; who approves; where approval is recorded]

## Audit log (where + what)
- [location; fields: time, input, tool calls, output, reviewer]

## Exceptions → routing
- [failure mode → human / retry-with-cap / stop]

## Kill switch
- [control, owner, what pausing breaks and preserves]

Finish line: one agent, fully bounded — every output placed on the spectrum, every forbidden action named, one gate owner, one kill-switch owner, one log location.

Verify: run a hostile walkthrough. "If the model hallucinates a source at midnight, what stops the draft from reaching the customer?" Trace the answer through gate, log, and kill switch. If any step is "we would notice," the boundary is unwritten. Write it.

Common failure mode: the helpful overreach — an agent granted send/publish "to save time" before its drafts earned trust. Its mirror is the unlogged helper: a script with write access nobody reviews because "it is just automation." Automation with consequences is an agent. Bound it the same way.

Confidence is a routing mechanism, not a score

A bare percentage helps nobody. Require the agent to attach its uncertainty to a routing action: high confidence with sources still goes to the review queue, medium confidence flags the specific doubtful claim, low confidence stops and asks for a missing input. Log the confidence alongside the output so Lesson 90.7 can correlate overconfidence with quality failures. Over a pilot, this log teaches where the boundary should move — perhaps re-fetches earn autonomy while peer comparisons never do. Boundaries are versioned decisions in DECISIONS.md, tightened or loosened only after evidence, never by optimism after one good run.

Multi-step agents inherit the strictest boundary of any step they contain. A workflow that collects freely but publishes occasionally is governed as a publishing agent, with the full gate, log, and kill switch of that highest step. Never average the spectrum positions. The matrix lists the ceiling capability first so reviewers see the maximum blast radius before reading the safe majority of steps.

Check your understanding

1. Why does "collect versus judge" place Sonariq's agent at prepare/recommend rather than autonomous action? 2. What must a kill switch name beyond the button itself? 3. Which of your agent's outputs sit at each spectrum step — and which step holds nothing yet?

Next

Boundaries make automation safe to run. Lesson 90.6 makes it safe to release — one valuable path for one user, with acceptance criteria, preview, and rollback planned before code.