Bounded actors

Agents

Each agent runs with an explicit allow-list; anything not granted is denied and recorded.

Discovery Agent

Allowed

extract_knownsgenerate_questionsupdate_domain_scores

create_projectapprovewrite_evidencemodify_rules

Evidence Agent

attach_evidenceclassify_evidencelink_truth_to_source

create_projectevaluate_rulesapprovemodify_rules

Reporting Agent

summarize_sessiongenerate_report

create_projectmodify_session_scoresattach_evidenceapproveevaluate_rules

Validation Agent

evaluate_rulesrecord_validation

create_projectmodify_session_scoresgenerate_questionsapprove