What a bounded agent looks like

A bank's support assistant answers "what's my balance?" and hands a help-article lookup to a knowledge agent along the way.

Consented scope

check_bank_balance

Tools in scope

mcp://ledger.internal/read_balance, read only

Data classes

reads account.balance; writes nothing

Downstream agents

agent://kb-search-agent, max hop depth 2

Hop budget

4

When it reaches further

terminate_account was never in the consented scope. The PDP refuses it with OUT_OF_SCOPE before the call goes out, and the refusal reaches the audit chain before the caller sees an error.

A release agent cuts a build and pushes it to staging on request, with production left to a human.

Consented scope

deploy_to_staging

Tools in scope

mcp://ci.internal/deploy_staging

Data classes

reads build.artifacts; writes deploy.staging

Downstream agents

none; this agent may not delegate

Hop budget

2

When it reaches further

A production deploy resolves to a tool the manifest never declared, so it is refused with OUT_OF_SCOPE before anything runs.

A reporting agent answers questions about product usage over the warehouse.

Consented scope

summarise_usage

Tools in scope

mcp://warehouse.internal/query

Data classes

reads metrics.aggregate only; customer.pii is not in the manifest

Downstream agents

none

Hop budget

2

When it reaches further

A query that touches customer.pii falls outside the declared reads and is refused with OUT_OF_SCOPE. The restriction sits on the data class, so it holds however the query is phrased.

A planner agent breaks a request into sub-tasks and hands them to specialist agents, each of which may delegate further.

Consented scope

research_and_summarise

Tools in scope

mcp://kb.internal/search

Data classes

reads kb.public, kb.internal

Downstream agents

agent://kb-search-agent, agent://summary-agent

Hop budget

3; the fourth hop has no authority left to spend

When it reaches further

The fourth delegation is refused with HOP_BUDGET_EXCEEDED. Depth comes from the signed token, so an agent cannot talk its way deeper.

An on-call assistant investigates a production decision: who authorized this call, and through which agents did the authority travel?

Consented scope

investigate_decision

Tools in scope

mcp://authz.internal/delegation_chain, read only

Data classes

reads audit.records; writes nothing

Downstream agents

none

Hop budget

1

When it reaches further

Any attempt to delegate, or to touch anything beyond the audit records, is refused with EDGE_NOT_IN_DAG. An agent that reads the audit trail cannot act on what it finds.

A research agent reads public pages and hands its findings to an agent that can act on them. One of those pages contains hidden text posing as an instruction.

Consented scope

research_public_sources

Tools in scope

mcp://fetch.internal/get

Data classes

reads web.public

Downstream agents

agent://summary-agent

Hop budget

3

Trust label rule

untrusted_external results may not reach a privileged tool

When it reaches further

A privileged call fed by an untrusted_external result is refused outright, even where the token would have covered it. The scope, edge and hop-budget checks above run alongside it.