# What stays under people's control — ten promises, and where each is shown

> Ten things that hold for every agent in an Osy# app: it does alone only what the app says; it never does for a person what that person may not do; a yes runs as the person who said it and covers only what was shown; every piece of work has a hard spending limit; somebody answers for every agent and can pause it; a correction becomes an instruction only when a person says so; everything is recorded and the record cannot be quietly changed; people read only what is theirs to read; and a person's data is erased on their request. Each is linked to the page that shows it and names the test that guards it.

<!-- id: agent-overview-control · area: agent · stability: preview · html: https://osysharp.com/reference/agent/overview-control/ -->

> **You are here:** [Agents in an Osy# app](https://osysharp.com/reference/agent/overview/) › What stays under people's control

## Summary        {#summary}
An [[agent-guide-glossary#agent|agent]] is useful only if the people around it can say exactly what it may do, see what it did, and stop it.
These are the ten things that are true of every agent built this way. None of them depends on the [[agent-guide-glossary#model|AI model]]
behaving well: they are enforced by the app around it.

Each one below says what it means, shows it where there is something to show, and ends with **Shown by**: the page
that explains it and the automated test that fails if it ever stops being true.

## Description    {#description}

### 1. It does alone only what the app says it may   {#alone}
For every action an agent can take, the app says one of three things: do it alone, propose it to a person first,
or never. If the app says nothing, the agent may only look things up, and everything that changes, sends or spends
is proposed.

An action marked "never" is not even offered to the AI model, and nobody can approve it.

**Shown by:** [[agent-autonomy#gate]] · tests `out_of_envelope_is_never_approvable` and
`Said_nothing_it_is_careful` ([[agent-guide-decisions#nothing|run on this page]]).

### 2. It never does for a person what that person may not do   {#never-past}
An agent has an account of its own with its own permissions. When it works for a person, it can read only what
**both** may read and change only what **both** may change. Asking an agent to do something for you never gets you
more than you already had.

**Shown by:** [[agent-agents#rights]] · tests `OnBehalfOfIsTheIntersectionTests` and
`What_the_agents_own_roles_do_not_allow_it_cannot_do_for_anybody`.

### 3. A yes runs as the person who said it   {#yes}
When somebody approves what an agent proposed, it is done with that person's permissions and on that person's
name. If they were not allowed to do it themselves, it is not done, and they are told.

![An approval that could not be carried out: the buyer said yes, but a buyer may not clear a supplier, so it was not done](https://osysharp.com/media/ref/8d0171-bakery-could-not.png)

*A buyer approved clearing a supplier. A buyer may not clear suppliers. The screen says so, and nothing happened.*

**Shown by:** [[agent-autonomy#approve]] · tests `an_approved_proposal_runs_as_the_approver` and
`approving_in_the_inbox_runs_it_as_whoever_approved`.

### 4. A yes covers what was shown, and nothing else   {#shown}
An approval is of one exact thing. If the order, the document or the supplier changed between the agent proposing
and the person deciding, the yes does not run: the [[agent-guide-glossary#proposal|proposal]] is marked out of date and the agent is told to look
again. The same happens when the agent's instructions changed in between.

When a proposal is sent to another team to decide, the person who asked for the work cannot approve it themselves.

**Shown by:** [[agent-autonomy#approve]], [[agent-autonomy#route]] · tests
`A_no_gives_the_agent_the_reason_and_a_yes_does_not_cover_what_changed` and
`whoever_the_work_is_for_does_not_decide_it_from_the_queue_she_works`.

### 5. Every piece of work has a hard spending limit   {#budget}
Each piece of work may spend at most a set amount on the AI model. Before each call, room for it is set aside; a
call that does not fit is not made. Work whose money runs out is stopped and keeps what it had done. Limits can
also be set for an agent in a day, for each run of a process, for a person and for the whole app.

When one agent hands part of a job to another, the part spends out of what the first has left. Money never grows
down the line.

**Shown by:** [[agent-budgets#runs-out]] · tests `a_spent_child_cancels_its_subtree` and
`a_limit_for_each_qualification_stops_an_agent_step_and_the_process_handles_it`.

### 6. Somebody answers for every agent, and can pause it   {#pause}
An agent does not run until a named person answers for it. That person, or anybody else the app puts in charge, can
pause it with a reason. A paused agent takes no new work, and whoever tries to give it some is told why.

![An agent's page while it is paused, with the reason and a button to let it work again](https://osysharp.com/media/ref/364e22-agents-management-agent-paused-wide-light.png)

A single piece of work can be called off, tried again, or handed to a person. Each of these is written down with
who did it.

**Shown by:** [[agent-roles#pausing]] · tests `A_paused_agent_takes_no_work_and_leaves_no_receipt` and
`pausing_is_refused_to_somebody_who_may_change_an_agents_place_in_another_way`.

### 7. A correction becomes an instruction only when a person says so   {#teaching}
Anybody who can see a piece of an agent's work can correct it. That changes nothing by itself. An [[agent-guide-glossary#instruction|instruction]] can
be drawn from corrections, by a person or by the agent, and it is only **proposed**. The agent is told it only
after a person the app trusts with teaching has read it and made it active. The agent cannot activate its own.

Every change makes a new numbered set of instructions. Each piece of work records which set it ran under, and an
agent can be put back to any earlier set.

**Shown by:** [[agent-teaching#instruction]], [[agent-teaching#sets]] · tests
`an_instruction_is_active_only_after_a_person`, `an_agent_cannot_activate_an_instruction_even_for_a_teacher` and
`a_task_records_the_version_it_ran`.

### 8. Everything is recorded, and the record cannot be quietly changed   {#record}
Every piece of work leaves a [[agent-guide-glossary#receipt|receipt]] — who asked, as which account it ran, what it cost, how it ended — and a
record of every step. Only the kit that runs the agents writes them; the app's own code cannot. Each line of the record carries a
fingerprint of the line before it, so a line that is changed, removed or slipped in afterwards is found.

**Shown by:** [[agent-task-log#chain]] · every example in this guide ends by checking it;
`The_assistant_prepares_a_commission_for_the_person_who_asked` on [[agent-guide-assistant#app]] is the shortest.

### 9. People read only what is theirs to read   {#reading}
The person the work was for, and the person who gave it, read all of it. Somebody who supervises the agents reads
that each step happened and what it cost, and **not** what was said in it. Reading what was said takes a separate
permission: auditing, or teaching. A bookkeeper can be given every figure and no words. Everybody else is told the
work is not theirs to see.

![One step of an agent's work as a supervisor sees it: "What it said is kept from you: you may see that this happened, not what was said."](https://osysharp.com/media/ref/8d0171-supplier-kept.png)

**Shown by:** [[agent-roles#words]] · tests
`whoever_teaches_reads_the_work_with_what_it_said_and_nobody_else_gains_by_it` and
`the_inspector_shows_each_reader_what_is_theirs_to_read`.

### 10. A person's data is erased when they ask   {#erase}
What agents did for a person, and about a person, is part of what that person can ask to see and ask to have
erased. By default what the work said is kept for a month and the fact that it happened for seven months; the
organisation running the app can change both. After an erasure the words are gone, the page says they were erased
and why, and the record still checks.

![A piece of work whose words were erased: it says when and why, and its record still checks](https://osysharp.com/media/ref/364e22-agents-processes-work-erased-wide-light.png)

**Shown by:** [[agent-privacy#erasure]] · tests `the_chain_verifies_after_a_person_is_erased` and
`what_was_erased_is_shown_as_erased_and_the_record_still_checks`.

### And the switch   {#switch}
An operator can turn AI off for an app while it runs, with no redeploy. Calls then fail, saying so; nothing is
sent anywhere. See [turning AI off (the runtime switch)](https://osysharp.com/reference/agent/ai-switch/).

## What to read next   {#read-next}
- [A supplier is qualified — five days, four agents, one that failed, and a three-day wait](https://osysharp.com/reference/agent/story-supplier/) — most of these ten, happening in one process over five days
- [What release 1 does not include](https://osysharp.com/reference/agent/overview-not-included/) — what release 1 does not include
- [The six decisions — what you say about an agent, and what holds if you say nothing](https://osysharp.com/reference/agent/guide-decisions/) — for developers: the six decisions behind these promises

## Go deeper   {#see-also}
- [What an agent does alone, what it proposes, what it never does — the gate and proposals (Agents kit)](https://osysharp.com/reference/agent/autonomy/) — alone, propose, never; what a yes covers
- [Who is in charge of an app's agents — every policy in one table, pausing, sponsoring, and trying work again](https://osysharp.com/reference/agent/roles/) — who may do what, in one table
- [What an agent may spend — a hard limit on every piece of work (Agents kit)](https://osysharp.com/reference/agent/budgets/) — spending limits
- [Correcting an agent, and what it is told from then on — corrections, instructions, instruction sets and rollback (Agents kit)](https://osysharp.com/reference/agent/teaching/) — corrections and instructions
- [The receipt and the record — what every piece of an agent's work leaves (Agents kit)](https://osysharp.com/reference/agent/task-log/) — the receipt and the record
- [Privacy for the agent family — agents, the model meter, assignments and work repositories under a person's request](https://osysharp.com/reference/agent/privacy/) — a person's copy, and their erasure