Trust
A web page or message can instruct an agent to misuse its access. Polychrome requires approval for requests to arbitrary addresses and external changes after a conversation reads outside content.
Outside content can contain instructions that attempt to misuse an agent's access. Polychrome restricts actions based on content provenance, without requiring text classification to identify an attack. After a conversation reads outside content, requests to arbitrary addresses and external changes require approval.
Outside content withdrew the permission to change an external system. Approving runs this one call; the other withdrawn action still asks.
Capabilities
A capability is a permission for a specific operation. Each action declares the capabilities it requires. Reading a workspace file requires local-file access. Fetching a web page requires access to an agent-selected address. Sending a message or opening an issue requires permission to change an external system. Polychrome compares these requirements with the conversation's granted capabilities:
- The action runs when the conversation has every required capability.
- A missing capability requires approval. The request explains the required permission and reason.
- A policy prohibition rejects the action without prompting.
Every action uses the same capability check. Unknown requirements use conservative defaults and trigger approval. A build-time check verifies that every built-in action declares its requirements.
Outside content withdraws capabilities
Reading outside content withdraws two capabilities: reaching an arbitrary address and changing an external system. Examples include a fetched web page or a message from someone else. Either capability could allow an agent to disclose data. Local reads and read-only calls to registered connectors remain available. Requests to arbitrary addresses and external messages now require approval. Polychrome checks capabilities before each action, including when outside content arrives during a turn.
The event log records content provenance. Policy, agent configuration, and action requirements remain outside the conversation. The agent cannot change these inputs by generating text.
Human approval
Frequent approval requests can lead people to approve actions without reviewing them. Polychrome tracks approval frequency so administrators can identify policy or labeling problems. On surfaces that offer it, you can choose to remember an approval. The remembered approval applies to your identity and that action, within the scope you approved.
WhatsApp offers Approve, Deny, and Deny & stop. It does not offer remembered approvals. Its edge can answer tool approvals in the chat, but an ask_question prompt must be answered on another surface. See WhatsApp support and limits.
Granting and removing access
Inviting a person, removing access, and removing an admin role always require human approval. Their required capability is never granted automatically. The approval card names the affected person. The agent can propose an action, but Polychrome reports completion only after approval and successful execution.
| You say | What happens | Restrictions | Undo |
|---|---|---|---|
| "invite @person" | Polychrome creates a single-use code and delivers it privately to the person. | Admins only. The code works once and expires. | An unused code expires on its own. |
| "remove @person's access" | Polychrome removes every identity link and blocks the person from accessing the deployment. | Admins only. Never the last admin, and never yourself. | Invite the person again. |
| "remove @person's admin role" | Polychrome removes the admin role. The person retains ordinary access. | Admins only. Never the last admin. | Another admin grants the role again. |
Removing access blocks future use and preserves the person's activity records. Polychrome computes the admin count from the log, including roles granted before the last-admin check existed. It rejects removal of the last admin.
Network enforcement
Built-in fetchers send requests through the control plane instead of opening connections directly. The control plane checks conversation provenance before making a request to an arbitrary address. It refuses requests from conversations whose outside content has withdrawn that capability. This enforces the rule again at the network boundary, independently of the action check.
Recovery
An admin can restore capabilities by excluding outside content from a conversation's active history. This operation is called excision. It excludes both the selected content and agent output derived from it. The append-only log retains the original records and adds a signed record of the removal, actor, and reason. The agent cannot perform excision. You can also start a new conversation.
# Clear the outside content a conversation took in; its web and
# outside access recover.
polychrome conversation excise <conversation-id> --all \
--actor slack:T…:U… --reason "reviewed, benign"See Payments for wallet spending approvals and Architecture for event-log storage and verification.