Least privilege, derived from intent.

You write what the agent is meant to do in plain English. Xybern derives an allowed and disallowed action set, plus guardrails, so the agent starts from least privilege rather than full access.

• Allowed and disallowed actions proposed from intent
• Guardrails suggested alongside the action set
• Reviewed and edited before anything is enforced

Run a profile in shadow to watch what the agent would have been blocked from doing, without affecting live work. When the boundary looks right, switch it to enforce and actions outside the box are blocked or escalated.

• Shadow mode surfaces would-be violations safely
• Enforce mode blocks or escalates out-of-box actions
• Boundaries are checked at the intercept, pre-execution

As an agent's job changes, its profile can be re-derived from the new description, so the boundary tracks the work instead of drifting toward over-permissioning.

Related capabilities on the same authorisation layer. Every one is enforced before an action runs and sealed to the Provenance Vault.