A bound is a limit on what an AI agent may do, checked at the moment the agent tries to act rather than assumed from how it behaved in testing. In a governed agentic operating system every action meets five bounds at once: role scope, certificate, sources, the customer's own limits and the platform guardrails. The lowest one wins.
Why do bounds matter for AI agents?
An agent's behaviour comes from a model that can be persuaded, confused or simply wrong. Instructions in a prompt shape that behaviour but do not enforce anything. A bound sits outside the model. It does not matter how confident the agent is or how persuasive the request; if the action falls outside a bound, it does not happen as proposed.
This is the central idea of agent governance is a bound, not a model. The model decides what to propose. The bounds decide what is permitted. Keeping those two separate is what lets a business explain, after the fact, why any action happened.
What are the five bounds?
| Bound | What it limits | Who sets it |
|---|---|---|
| Role scope | Which tasks belong to this agent at all | The business, in the agent's brief |
| Certificate | The depth the agent has proven | Evidence from certification on the customer's own cases |
| Sources | Whether the facts behind an action are strong enough | Provenance rules; an external claim cannot authorise a payment |
| Customer limits | Amounts, counterparties, hours, volumes | The customer |
| Platform guardrails | Actions withheld for every agent at every depth | The platform |
All five are checked for every action. If they disagree, the most restrictive applies, and the verdict records which one that was. That bound is called the deciding bound.
What does that look like in an example?
An insurer's claims agent is certified at depth 4 to pay small claims, and the customer's limit for unreviewed payments is 1,000. A claim for 600 arrives. Role scope: yes. Certificate: in date, depth 4. Customer limit: under 1,000. Platform guardrails: nothing withheld. But the claimant's bank details came from an email reply rather than the policy record. The sources bound fails, because an external claim cannot authorise a payment. The verdict names sources as the deciding bound, and the payment is held until the details are confirmed from the policy record.
Four bounds would have allowed the payment. One did not, and that one decided.
How is a bound different from an eval score?
An eval score describes how an agent performed on a set of test cases. It is evidence, and useful evidence. But it does not stop anything. An agent that scored highly last month can still be talked into an action it should not take today. A bound is enforced at the moment of action, whatever the agent's history. The point is made directly in an eval score is not a bound.
Certification links the two. Evidence from replaying the agent against real cases sets the certificate bound, so a score becomes a bound only once it is turned into a specific depth for a specific agent, with an expiry date.
Which related terms should you know?
- Minimum chain: the rule that all five bounds apply at once and the lowest wins.
- Verdict: the recorded outcome of checking an action against the bounds.
- Depth: how far an agent may act, which the certificate bound sets for the agent.
Why each verdict should name its bound is argued in why every agent decision needs a named bound.
Questions people ask
Can a bound be changed while an agent is running?
Yes, and the change applies from the next action. A customer can lower a limit, a certificate can lapse, or a source can be downgraded. Each change is recorded, so any later verdict can be read against the bounds that applied at that moment.
Is a bound the same as a permission?
No. A permission says a system may call a function. A bound says whether this action, now, with these facts, is within limits. An agent can hold a permission and still be stopped by a bound, which is the point.