Resources
What we are building, and what we have learned building it.
The normal way a coding agent gets access to a service is that you paste a key into your terminal. That habit is the reason credential theft works, and we all have it.
A bookkeeping assistant. Blocked topic: "personal tax advice", which is a perfectly reasonable thing not to want your product doing. It caught "What is the mileage rate for 2026?" — a company reimbursement rate, and about the most on-domain question that corpus could be asked.
The tool was called cancelbooking. Its description read: "Cancel a booking. Irreversible: the slot is released to the market immediately." The project granted approvals. There was an onApproval handler that refused everything. It was never once consulted.
Almost everyone gets retrieval scoping right. The agent cannot read the wrong customer's documents. Then it calls a tool, and the tool goes and fetches them, because the tool runs as your service account and nobody re-checked.