Use casesClear boundaries for every agent.
These are example policies for agent integrations, not a list of released destination connectors. Enforcement requires a controlled execution path, exclusive gateway credentials, and no alternate agent route. Check current integration coverage.
The risk without CLAIIMSupport agents need to read tickets and prepare responses. If they can also send responses or issue refunds, a bad draft or a classification error becomes a real customer action.
Example allowed requestsRead tickets, draft responses for human review, tag tickets
Example denied requestsSend responses directly, issue refunds, process billing changes, close accounts
Proof in ChronSubmitted draft and billing requests record the gate decision, governing rule, and responsible person. A decision does not prove delivery or prevention outside the integration.
The risk without CLAIIMFinance agents need reporting access to produce summaries and forecasts. If they can also approve payments or move funds, a model error becomes a financial incident.
Example allowed requestsRead reports, read budget data, generate summaries
Example denied requestsApprove payments, initiate transfers, modify financial records
Proof in ChronGate records show the evaluated finance scope and the decision for submitted requests. Separate database or payment credentials remain outside that boundary.
The risk without CLAIIMOperations agents can save hours drafting offer letters, contracts, and internal communications. If they can also send, a draft error becomes a real commitment before a person has seen it.
Example allowed requestsDraft offer letters, prepare internal reports, read HR data
Example denied requestsSend correspondence directly, modify employment records, approve headcount
Proof in ChronSubmitted requests and required approvals are recorded with the responsible person. A gate approval is authorization, not independent evidence that correspondence was delivered.
The risk without CLAIIMA deployment agent with production access is one misconfiguration away from an outage. Without a governance layer, you cannot prove what actions were allowed before they happened.
Example allowed requestsDeploy to staging, roll back staging, check service health
Example denied requestsDeploy to production, roll back production, destroy infrastructure
Proof in ChronChron records staging and production gate decisions with agent identity, responsible person, and rule. GitHub and CI/CD reference connectors remain planned; the rehearsal does not perform deployments.
The risk without CLAIIMInfrastructure automation agents can destroy environments, drop databases, or modify clusters. Without a pre-approval gate, the blast radius of an agent error is unlimited.
Example allowed requestsApply pre-approved change orders, read infrastructure state
Example denied requestsDestroy resources, modify schemas, act without prior human approval
Proof in ChronApproval and session records support review of submitted requests. Raw shell commands and local file edits are outside current enforcement coverage.
See CLAIIM in your own environment.
