Bring your own AI agent.

The agent is a CMS user. Not a special kind of integration with its own settings screen and its own idea of what it may do — a row in the same table as your staff, in a group you chose.

That has consequences worth spelling out:

• You widen or narrow what the agent can do by editing a group, not by reissuing a token or asking us to change anything.
• A tool you buy later is reachable by the agent the day its group gets it.
• The list of tools the agent is handed is your permission model, written out.

There is no second set of rules to keep in step with the first, which is the whole design. And it is bounded twice: what your installation includes, then what the group grants.

Permissions decide what it may do. Two further bounds decide what it cannot turn into, and neither is a permission you could accidentally grant.

It cannot write code. Any change carrying a PHP opener is refused outright, and the refusal names the exact field. This matters because templates are meant to hold code — so a group holding Templates, an ordinary thing to hand out, would otherwise reach a surface where writing a few characters means running a program on a server sixteen other businesses share. No arrangement of groups closes that, so it is refused to the agent itself.

There is an hourly ceiling. Five hundred records an hour, per token. That is not a defence against a hostile agent — an authorised one is doing what you allowed. It is a limit on how far a loop gets, which is the mistake an agent actually makes: not one error, the same error five hundred times.

Work an agent does is grouped into a named batch, and any batch can be reverted — every record in it back as it was, in one action, from the admin, without asking the agent anything. The site is republished as it goes back, so its pages say what they said before.

Two honest limits. An agent can only remove a record to the Trash — it can never delete one for good — and a revert leaves it there, so it comes back from the Trash. And a change made through a screen that keeps no history of its own cannot be put back: it still counts in the batch, and the agent is told so the moment it makes it.

The shop, the hotel and hiring are reached the way everything else is: when the agent’s group opens them. Their records are customers, guests and job applicants — other people’s personal data, held on your behalf — and so is everything sent through your forms. Whether an agent sees any of it is a choice to make deliberately, and you make it in the same grid as everyone else’s: give the agent’s user a group without those tools, and it never sees a record.

Some things no group can hand an agent, because they are about who it is rather than what it does: users and groups, how anybody signs in, and Agent Access itself — so it cannot issue, widen or undo a token. Nor can it set a password or a key, delete anything for good, download the export of the whole site or, as above, write code.

And because this is an admin door like any other, an installation that restricts its admin to certain addresses restricts this the same way.