# Agents with their own identity and their own limits

> On Substrait an agent is a tool its builder owns. Each agent has its own scoped identity, authority never wider than its owner's, a check on every action, a record of whom it acted for, and a switch on its identity.

URL: https://substrait.build/capabilities/governed-agents/  
Last updated: 2026-11-06

On Substrait an agent is a tool its builder owns, governed like every other tool and then some. Each agent has its own identity, authority narrower than its owner's, a check on every action as it happens, and a switch that stops it at once.

## Four properties of every agent

1. **Its own identity.** Substrait issues each agent a scoped, revocable identity. An agent never uses its owner's standing credentials.
2. **Narrower than its owner.** An agent's authority is the smaller of its owner's groups and what the agent was granted. Everything else is denied.
3. **A record of whom it acted for.** Every action reads "this agent, acting for this person". One accountable person stands behind every action.
4. **A switch on the identity.** Revoking the identity stops the agent at once.

## Checked as it acts

An app's reach is known before it goes live; an agent's is decided at runtime.
Substrait therefore checks each action an agent takes, at the moment it takes it.
That matters because content an agent reads, such as an email or a supplier's document, can try to redirect it.

## Who may operate agents

Operating an agent is a capability your admins grant to a person.
The agent itself holds no seat.

## How agents ask people

When an agent needs a human decision, it asks through Substrait's communications centre.
The right person answers from the channel they chose.

## Related

- [How to run AI agents on company systems, safely](https://substrait.build/problems/run-ai-agents-on-company-systems-safely/): An agent decides at runtime what to do. Substrait gives each agent its own identity, limits narrower than its owner's, a check on every action, a record of what it did for whom, and a switch that stops it.
- [Company data, granted by its owner](https://substrait.build/capabilities/governed-data-access/): A tool on Substrait reads company data only after the data owner approves it, for a set time, through one gateway that holds the credential, checks every call and records every read.
- [The communications centre: one pre-wired exchange for the whole organisation](https://substrait.build/capabilities/communications/): The communications centre is one central, pre-wired exchange that connects every alert, approval, notification and message across the organisation. Every tool built on Substrait calls it, so no tool builds its own. The company hooks in its own Slack, Google Chat, Teams, email or WhatsApp, and each person chooses the channel.
- [An audit trail nobody can alter](https://substrait.build/capabilities/audit-trail/): Substrait records every access and action in an audit trail that nobody, a platform admin included, can change after the fact. It is queryable, exportable to your security monitoring, and kept in storage you control.