Bring your own AI agent.

The agent is a CMS user. Not a special kind of integration with its own settings screen and its own idea of what it may do — a row in the same table as your staff, in a group you chose.

That has consequences worth spelling out:

• You widen or narrow what the agent can do by editing a group, not by reissuing a token or asking us to change anything.
• A tool you buy later is reachable by the agent the day its group gets it.
• The list of tools the agent is handed is your permission model, written out.

There is no second set of rules to keep in step with the first, which is the whole design. And it is bounded twice: what your installation includes, then what the group grants.

Permissions decide what it may do. Two further bounds decide what it cannot turn into, and neither is a permission you could accidentally grant.

It cannot write code. Any change carrying a PHP opener is refused outright, and the refusal names the exact field. This matters because templates are meant to hold code — so a group holding Templates, an ordinary thing to hand out, would otherwise reach a surface where writing a few characters means running a program on a server sixteen other businesses share. No arrangement of groups closes that, so it is refused to the agent itself.

There is an hourly ceiling. Three hundred records an hour, per token. That is not a defence against a hostile agent — an authorised one is doing what you allowed. It is a limit on how far a loop gets, which is the mistake an agent actually makes: not one error, the same error three hundred times.

Work an agent does is grouped into a named batch, and any batch can be reverted — every record in it back as it was, in one action, from the admin, without asking the agent anything.

Two honest limits. A revert restores records, so a deletion comes back from the Trash first — which is why no delete is offered to an agent at all in this release. And saving is not publishing: if a change did go live, putting the record back does not un-publish the page, so the site needs publishing again.

The shop, the hotel and hiring have no agent tools at all, and that is a decision rather than a gap. Their records are customers, guests and job applicants — other people’s personal data, held on your behalf. Opening those to an agent is a choice somebody should make deliberately, not something that arrives because a file was added.

Forms are the same line drawn finer: an agent can read how a form is built, and cannot read a single thing anybody submitted through it.

And because this is an admin door like any other, an installation that restricts its admin to certain addresses restricts this the same way.