[ PROOFECONOMY ]™GlossaryOriginSpecsAgent Boundary
An agent boundary is the line between what an AI agent is allowed to do and what it is not, the tools, targets, data, credentials, delegation, memory and budget on its list, together with the enforcer outside the agent that checks every action against that list. A boundary written in the agent's prompt is a suggestion; one enforced in code outside the agent is a wall, and Proof Protocol measures whether the wall holds.
The two halves
The list. What the agent may do:
- Tools: which actions it can take (read a page, write a file, run a command, send mail)
- Targets: where it may use them (these hosts, this folder, this table)
- Data: what it may see, and what it may send out
- Credentials: which keys and accounts it holds
- Delegation: whether it may create or hand work to other agents
- Memory: what it may store for later
- Budget: how much time, money and how many actions it gets
The enforcer. Something outside the agent that checks every action against the list and blocks anything not on it.
Prompt versus code
“Please do not send data outside” in a system prompt is text, and a planted instruction in a web page can talk the agent out of it. A check in code outside the agent cannot be talked out of anything. The agent can be fully deceived and still cannot get past it. That difference is the whole subject.
In Proof Protocol
- The list is the Declared Policy: committed, hashed and anchored before the run.
- The enforcer is the Warden, the Device Under Test in a Jailed Canary Protocol run.
- Whether the boundary holds is measured, not asserted: bait invites the agent across the line, the Warden arrests it, an independent witness records whether the arrest held, and the Jail Efficacy Rate is published with the False Arrest Rate and Escape Rate.
- A path the enforcer does not sit in is not part of the boundary. It is an untested escape vector, published as not proven.
Why this matters
Everyone describing an agent product describes its list. Almost nobody publishes how often the enforcer held under attack, how often it blocked legitimate work, who watched, and which paths it does not cover. A boundary without that record is self-attestation.