Governed access path
The chain of command for agent access.
Someone asks. A login is chosen. Rules run. A receipt is written. Every call an agent makes travels that chain in order — and a call that cannot be recorded does not run.
01 Seven steps
Someone asks. A login is chosen. Rules run. A receipt is written.
Every call passes through all seven stages in order. Select a stage to read what it does.
Someone asks
Permission set
Login
Tool
Rules
Outcome
Receipt
01
A person asks an agent to do something, starting from a permission set that proposes a login, a set of tools and a time limit.
02
A reusable starting point. Saving it grants nothing on its own.
03
The session is tied to specific app logins, and each login carries its own list of allowed tools.
04
Only tools on the approved list can be reached — nothing else the app happens to offer.
05
Rules let the call through, block it, hold it for a person, or trim it — before it leaves.
06
The call goes out, or it is refused, against the approval for that one session.
07
What happened is written down and linked to the record made before it. A call with no record does not run.
02 Your apps
Decide what your apps can offer
An admin connects an app and reviews the list of tools it offers before anyone on the team can pick from it.
An app update pauses changed tools and hides new tools until an admin reviews the list.
App zendesk · v4 → v5
New bulk_close hidden
Changed create_ticket paused
Removed legacy_search stopped
The person, session, tool and exact request bind one create_ticket call to one decision before the call goes out.
Requested by ana.duarte@northwind.co
Session ses_9f21c4
Tool create_ticket
Request fingerprint sha256:4b1e…09c7
03 Policy
Enforce every decision, including extra approval
Nothing is allowed by default. Your rules run, and if one of them asks for a person, the call waits for that decision before it leaves.
Next step
Where to go next
Two readers, two different next steps.