Allowed is the verdict a governed agentic operating system gives when an AI agent's proposed action sits inside every bound at the same moment: its role scope, its certificate, its sources, the customer's own limits and the platform guardrails. The agent may carry the action out now, without waiting for a person. The verdict, and the bounds checked, are filed.
Why does "allowed" need a definition at all?
In most software, an action is allowed if the user has the permission. For agents that is not enough. An agent may hold the technical right to call a refund function and still not be entitled to issue this refund, to this customer, for this amount, today. "Allowed" in a governed system means the specific action passed every test at the moment of action, not that a credential exists.
That makes allowed a narrower and more useful word. It says the agent was in its role, certified for this capability at this depth, working from sources good enough to act on, inside the customer's limits, and clear of anything the platform withholds. If any one of those fails, the verdict is something else. The idea is set out more fully in agent governance is a bound, not a model.
How is an action allowed in practice?
Each proposed action is checked against five bounds, and the lowest one wins:
- Role scope: is this task part of the agent's job?
- Certificate: is the agent certified for this capability at this depth, and is the certificate in date?
- Sources: are the facts behind the action strong enough? An emailed instruction cannot authorise a payment.
- Customer limits: does the action sit within the amounts, hours and counterparties the customer has set?
- Platform guardrails: is the action outside anything withheld for every agent?
Only if every answer is yes is the action allowed. Who should set those limits is discussed in who should decide what an AI agent is allowed to do?
What does that look like in an example?
A retailer's support agent is certified to issue refunds at depth 4, and the customer's limit for refunds without review is 50. A shopper asks for a refund of 40 on a damaged item, with a photo and an order in the order system. The action is in role, certified, grounded in the order record, under the limit and not withheld. Allowed: the refund is issued and the verdict is filed. Ten minutes later another shopper asks for 80. Same agent, same capability, but the customer's limit decides. The verdict is held, and a person approves or declines.
How is allowed different from held and refused?
Allowed means the agent acts now. Held means the agent drafts the action and a named person decides. Refused means the action is outside the agent's bounds and does not happen. A fourth verdict, withheld, applies when the platform itself never lets any agent take the action. The four are compared in allowed, held, refused, withheld.
Allowed is also not permanent. The same action can be allowed today and held next week if the certificate lapses or the customer lowers a limit. The verdict is about one action at one moment.
Which related terms should you know?
- Bound: one of the five limits every action is checked against.
- Deciding bound: the bound that determined the verdict.
- Depth: how far an agent may act for a capability.
- Some actions should never be allowed for any agent; examples are in what should an AI agent never be allowed to do?
Questions people ask
Does "allowed" mean nobody checks the action?
No. Allowed actions are filed in the append-only record with the bounds that cleared them, and they can be sampled, reviewed and reconstructed. What allowed removes is the wait for approval before the action, not the oversight after it.
Can a customer make an action allowed that the platform withholds?
No. Customers can narrow what an agent does through their own limits, which turns actions into held or refused. They cannot widen past the platform floor. Withheld actions stay withheld for every agent at every depth.