Agent controls

Autonomy needs hard boundaries.

Decide what an agent can read, change, and spend. Enforce the policy on the server, not in the prompt.

{
  "scopes": ["domains:read", "domains:transfer"],
  "max_per_tx": 100,
  "max_per_month": 250,
  "expires_in": 86400
}

The model cannot talk its way around the policy.

Scopes and limits are checked by the API before a sensitive operation begins.

Least privilege by default

Create read-only, short-lived, or delegated tokens. A child token cannot gain scopes or spending power its parent does not have.

domains:read

email:write

backorders:write

domains:transfer

Spending stops at the cap

Set per-transaction and monthly ceilings. Paid endpoints reject the action before charging when a limit is exceeded.

Every sensitive action is attributable

Audit events capture the actor, token, action, target, amount, approval source, request ID, and time.

Retries should not buy twice.

Paid operations and message sends support idempotency. The same key returns the original result instead of repeating the side effect.

Domain registration and renewal
Transfers and marketplace purchases
Offers and deal finalization
Agent and mailbox provisioning
Outbound email sends

DNS changes stay recoverable.

Concurrency checks

Zone versions prevent stale agents from overwriting a newer change.

Dry runs

Preview the resulting zone and validation errors before mutation.

Automatic backups

Sensitive DNS changes capture a restorable snapshot.

Diff and restore

Inspect what changed and return to a known zone state.

Give the agent exactly enough access.

Start narrow, add explicit limits, and expand only when the workflow proves it needs more.