What an agent reads, writes, proposes, and may never do. Companion to Lesson 90.5. Copy into FINAL-PROJECT/AGENT-BOUNDARIES.md and complete one matrix per agent or workflow.

The blank matrix

# AGENT-BOUNDARIES — [Agent/workflow], [date]

## Role
- [one line]

| Capability | Spectrum position | Gate / approver | Log location |
|---|---|---|---|
| [e.g., fetch filings] | collect | none (read-only) | … |
| [e.g., draft brief] | prepare/recommend | human source-check: [owner] | … |
| [e.g., send to client] | NEVER | — | — |
| [e.g., retry failed fetch ×2] | bounded-auto (cap: …) | auto, then escalate | … |

## Reads (with permission)
- …

## Writes (each with gate)
- …

## Must NEVER
- [publish / send / charge / delete / …]

## Memory / state
- [where + retained vs discarded]

## Confidence → escalation
- [low-confidence signal → routes to whom, how]

## Exceptions → routing
- [mode → retry-cap / human / stop]

## Kill switch
- [control + owner + what pausing preserves]

Spectrum reminder: collect and prepare → recommend → act with approval → bounded autonomous action (capped, logged, reversible) → never delegate. When in doubt between two adjacent steps, choose the stricter one and let evidence from Lesson 90.7 earn the loosening.

Filled miniature (Sonariq structuring agent, illustrative)

Role: collect and structure filings with links. Fetch filings: collect, read-only. Draft brief: prepare, gate Maya's source-check. Interpret evidence ("this supports X"): recommend, never auto-stated as fact. Publish/send: NEVER. Retry failed fetch twice: bounded-auto, then escalate. Log location holds time, inputs, tool calls, output, and reviewer for every run. Kill switch: owner pauses scheduler; drafts preserved, nothing sends. New hires read this matrix before touching the workflow.

Scaling the matrix

One matrix per agent, and re-sign it whenever tools, permissions, or spectrum positions change. A new write permission is a new row with a new gate — added before the key is granted, never after. Review all matrices in the Lesson 90.9 weekly operations slot: confirm the log location still exists, the gate owner is still available, and the kill switch was tested this quarter. Boundaries decay silently when teams grow; the re-signing ritual keeps them explicit.

Verify fast

Hostile walkthrough: "model hallucinates a source at midnight — what stops it reaching the customer?" The answer must trace gate → log → kill switch with names, not "we would notice." Then count writes without gates. The correct number is zero. Finally confirm the matrix lives where the agent runs: linked from AGENTS.md, reviewed in the weekly operations slot, and re-signed whenever a tool, permission, or spectrum position changes.