01
Marketing agent
Edit one page without publishing it
Grant page reading and editing for one profile. Keep publication, address changes and deletion outside the role.
SolutionsAI governance
Give every AI agent the access its job requires.
Control capabilities, specific resources, connected API tools, budgets and access periods. Review requests, change the policy and revoke access from one workspace.
Permission is an executable boundary
An agent can ask for more access. A person decides.
The workspace policy is a ceiling. Effective access combines the granted scope, current policy, selected resources, credential validity and agent connection.
02
Support agent
Answer customers without private memory
Use a dedicated channel credential and approved read operations. Public messages cannot expand fixed API arguments.
03
Operations agent
Use a CRM or finance API within a budget
Connect the account through a reviewed integration, authorize an exact tool for one agent and remove it without exposing the provider credential.
04
Administrative agent
Delegate governance with a separate ceiling
An owner can grant selected administrative areas to a root agent. That authority is explicit, expires and is not inherited by child credentials.
Use a different boundary for every agent job.
The policy becomes useful when it changes what an agent can see and do at the moment of the call.
01 · Marketing
Prepare one public page without publication access
Select the page, allow reading and editing and keep address changes and deletion outside the role.
Explore →02 · SupportAnswer one assigned conversation without private memory
Use a channel credential and a dedicated agent environment for visitor driven input.
Explore →03 · OperationsCall one connected API tool within a budget
Authorize the exact operation for one agent without showing it the provider credential.
Explore →A written rule cannot stop an unauthorized request.
Documents and prompts explain intent. instanceof.ai checks the credential, scope, policy and selected resource before executing its tools.
Instructions onlyinstanceof.ai
EnforcementInstructions onlyThe agent is asked to remember the ruleinstanceof.aiThe server rejects access outside the grant
ResourcesInstructions onlyOne role often sees the whole accountinstanceof.aiA connection can reach selected pages, forms or channels
ChangeInstructions onlyReplace prompts and redistribute secretsinstanceof.aiUpdate policy, expiry or resource selection centrally
What you should know before you connect.
Can an agent approve its own request?
No. It may explain and request missing scopes. A person reviews the request, and approval cannot exceed the workspace policy.
Can this control every API my agent can reach?
It controls instanceof.ai tools and external API operations connected through its integration layer. It does not control unrelated browser sessions, files or credentials already available on the agent host.
What happens after revocation?
New calls recheck the live credential and policy. Revocation cannot undo an external action that already completed.
Are provider secrets shown to the agent?
Connected credentials remain with the provider or in the credential vault. The agent receives the approved operation, not the secret.