The minimum chain is the rule that every action an AI agent attempts is checked against five bounds at once: its role scope, its certificate, its sources, the customer's own limits and the platform guardrails. The lowest of the five decides, and the verdict records which bound that was.
Why does the minimum chain matter?
Most agent controls are single gates. A permission system says yes or no; a policy prompt asks the model to behave; a spend limit caps amounts. Each catches some failures and misses others. An agent with the right permissions can still act on an unverified source. An agent within its spend limit can still be acting outside its role.
The minimum chain closes those gaps by requiring every bound to agree. No single generous setting can lift an agent above what the others allow, and nobody has to remember which control applies to which action.
How does it work in practice?
For each attempted action, five questions are asked together.
| Bound | The question |
|---|---|
| Role scope | Is this action part of the agent's job at all? |
| Certificate | Has the agent proven this capability, at this depth, on this customer's cases, within 90 days? |
| Sources | Are the facts behind the action strong enough? An external claim cannot authorise a payment. |
| Customer's own limits | Is it within the amounts, hours, counterparties and approvals the customer has set? |
| Platform guardrails | Is it something the platform withholds for every agent? |
The answer is one of four verdicts: allowed, held for a named person, refused, or withheld. The verdict names the bound that decided it, and it is filed in an append-only record. A full walk-through is in the minimum chain explained.
What does an example look like?
Take a business bank's payments agent asked to pay a supplier 40,000. Its role covers supplier payments. Its certificate supports depth 4 for payments. Its sources: the supplier's bank details are sealed, from the bank's own records. But the customer's limit for unattended payments is 25,000. The lowest bound is the customer's limit, so the verdict is held, and it says so. A finance manager sees the payment, the reason it was held, and approves or refuses it.
Change one fact. The bank details came from an emailed invoice instead. Now the sources bound is lowest, and the payment cannot proceed on that basis however large the limit.
How is the minimum chain different from layered permissions?
Layered permissions stack checks in sequence and stop at the first failure, often without saying which layer failed. The minimum chain evaluates all bounds every time and reports the deciding one. That matters for two reasons. People reviewing a held action know exactly what to look at. And when you want an agent to do more, you know which bound to work on: more evidence for the certificate, better sources, or a change to your own limits.
It is also separate from the model's reasoning. The chain does not ask the model whether the action is safe; it checks facts about the action that the model cannot change.
Which terms relate to it?
Sector rules can sit inside the chain. In US healthcare, for example, how HIPAA limits what health information an agent may access is enforced through role scope and sources. Depth, certificate, held and withheld each describe one part of the chain. Our guide to agent governance sets out how they fit together.
Questions people ask
Can a customer turn off a bound?
A customer can set its own limits as tightly as it likes, which narrows what agents may do. It cannot remove the certificate, sources or platform guardrails, because those are what make the verdict trustworthy.
Why name the deciding bound?
Because a refusal or hold without a reason cannot be reviewed, appealed or fixed. Naming the bound turns every verdict into evidence that can be reconstructed later.