What is your agent allowed to do?
Fifteen questions about the run your agent is executing right now. Not about what it usually does — about what it is permitted to do, and what would happen if it tried something else. Most teams can answer the first five and stall on the rest, which is itself the finding.
Nothing you type here leaves your browser. There is no account, no email field and no submit button — the page makes no network request at all once it has loaded. Close the tab and the answers are gone. If that matters to you, it is the same disposition we take with your prompts: what leaves your process.
Spend ceiling
A dollar amount this run may not exceed, declared before it starts.
Does a single agent run declare a maximum dollar amount it may spend?
A per-run figure. An account-level or monthly cap is a different thing — it stops the tenth runaway run, not the first.
If a run exceeded that amount mid-task, would something stop it?
As opposed to recording that it happened, or alerting after the fact.
Is that check made before the model call fires, rather than after it returns?
A check that runs after the response has arrived has already paid for it.
Step ceiling
A limit on how many steps this run may take, chosen rather than inherited.
Does a run declare a maximum number of steps?
Was that number chosen by your team, rather than left at your framework's default?
If nobody can say why it is the number it is, it was inherited.
Tool allowlist
The set of tools this run may call, named in advance.
Is there a written list of the tools a given run is permitted to call?
The set of tools you registered with the model is what it CAN call. This asks about what it MAY call on this particular run.
Is a tool call checked against that list before it executes?
Can one run be given a narrower list than another?
A nightly cleanup job and a customer-facing agent rarely need the same tools.
Write ceiling
Destructive actions distinguished from reads, with a declared limit.
Does your system distinguish a read from a reversible write from a destructive one?
Can a run be started that is permitted to read but not permitted to delete?
Without a human in the loop for each action.
Where the guarantee lives
Whether the boundary survives the agent process that it governs.
Do these limits live outside the agent's own process?
A counter in the loop is enforced by the same code it is meant to constrain.
If the agent process crashed and restarted mid-task, would its spend so far still count against the ceiling?
In-memory state resets to zero on restart. So does the protection it was providing.
Is the boundary enforced by something other than an instruction in the system prompt?
"Do not delete anything" is a request. It is not a guarantee.
Record of decisions
A durable record of what was permitted and refused — not a trace of what happened.
Is there a durable record of what was permitted and what was refused, run by run?
A trace records what the agent did. This asks whether anything recorded what it was allowed to do.
Could you say how many of your agent's steps ran last month with no limit applied at all?
Including steps that ran while a monitoring or governance service was degraded or down.
Your boundary map
Six things a run can declare. This is what you said about yours. 15 questions still unanswered.
Unknown is not a softer no. A boundary you know you haven't declared is a decision. One you can't answer for is a blind spot, and it is the more urgent of the two — so it is kept as its own state everywhere on this page, including in the text below.
Plain-text summary
Want to see a declared boundary stop a run? npx @thsky-21/thskyshield-demo — about four seconds, no signup.