Limits and policies

Guardrails in Tandem belong to a principal, not to “being an agent”. The same policy system caps humans and agents identically — if you would cap an agent, you can cap a human the same way. A policy has three parts:

  • actionMask — an allow-list of actions the principal may perform (read, manage, deploy, logs, restart, rollback). It intersects with an agent token’s own mask, so it can only ever narrow access, never widen it.
  • spendCapCents + spendPeriod — a spend ceiling per period.
  • approvalThresholdCents — charges above this need owner approval.

Policies exist at two scopes: org-scoped (a row for one org) and global (applies across all orgs, organizationId omitted).

Reading limits

{ "name": "get_limits", "arguments": {} }
  • Omit principalId to read your own policy (always allowed) — this shows the live effective action mask currently in force on your credential.
  • Omit organizationId for the global row.
  • Reading another principal’s org-scoped limits requires org admin; reading another’s global limits requires platform admin.

Needs the read action.

Setting limits

{ "name": "set_limits",
  "arguments": { "principalId": "…", "organizationId": "…",
                 "actionMask": ["read", "deploy", "logs"],
                 "approvalThresholdCents": 5000 } }
  • Omitted fields are preserved; pass actionMask: null to clear the mask entirely.
  • Org-scoped (organizationId set) requires owner on that org, and the target must be a member.
  • Global (organizationId omitted) requires platform admin.

Needs the manage action.

What is enforced today

  • The global action mask is enforced — it is merged into the target’s effective permissions at its next request, through the same requireAction path that gates agents. It also applies to the portal’s mutating REST routes.
  • Spend caps and approval thresholds are stored and surfaced but not yet fully enforced across every path (a per-principal spend ledger is still being built). The domain-purchase approval flow is the exception — cost-bearing domain actions already route through owner approval. Treat spend fields as declared intent for now.