Agentic Routing Policy
What are our agents allowed to do?
Who asks
Engineering ships agents faster than anyone approves them, so this lands on the security or IT lead, usually when an agent already running against production comes up for a sign-off nobody has a standard for.
What we look at
We start from the agents that already exist and read their tool definitions rather than their descriptions, because the tool list is where the real reach lives. For each credential a tool holds, we follow what it opens and what that in turn opens, and review the union rather than the individual grants. Each agent is then placed on the line between judgment and authority, separating the ones that investigate and draft from the ones that execute, and every gate in front of an irreversible action is examined to see whether it runs in ordinary code or asks a model to judge its own work. Spend ceilings, step caps, and what each run writes to a ledger get the same treatment.
What you get
Key deliverables
- An agent inventory covering what exists, what it reaches, and what it may do
- The judgment and authority line, drawn per agent
- A gate design, including fail-closed behavior and who may pass it
- A data reachability map covering transitive tool access
- Spend ceilings and loop bounds
- A traceability standard covering what is recorded and for how long
- Model selection policy, folded into the same artifact
What this does not cover
This engagement designs the policy and does not implement it. The gate has to be built in your own systems by the people who own that code, because a gate sitting anywhere other than the execution path is a document. Terms review across model vendors, meaning retention, logging, and which subprocessors sit in the path, belongs to the Vendor and Cost Review, and the policy written here either assumes that reading has been done or records that it has not.
What lands in the platform
What lands here is the inventory rather than the policy. The tools those agents use are registered in the vendor catalog and assigned to the departments using them, and the policy itself stays a written document. Nothing here sits in the path of a live request, so the platform will not block a call, and every gate you design has to hold in your own systems.
Next step
Send the tool definitions for one agent that already runs against production, and we will map what it actually reaches before anything else gets decided.