Explore how an agent’s identity, resource and request determine what it can do across support, payments and operations.
Customer record
Policy outcomes
01 / Customer operations
Give a support agent access to the record linked to its assigned ticket. Compare that request with a cross-tenant lookup or a deletion to see what the delegated grant covers.
Explore customer operationsRefund review
Policy outcomes
02 / Financial actions
Let a billing agent prepare a refund while the executor checks the amount and the request’s approval. Compare a small refund, a reviewable refund and one outside the agent’s limit.
Explore financial actionsService incident
Policy outcomes
03 / Internal tools
Give an incident-response agent temporary access to the affected service. Compare the permitted log query with access to another service or a credential change.
Explore internal toolsGive a support agent read access to the customer record associated with its assigned ticket. Pass the tenant and record identifiers to the policy check so a valid read scope can’t be used to fetch another tenant’s data.
Check: A read for the assigned customer succeeds. A cross-tenant read and a deletion request are both denied.
Let an agent prepare a refund proposal with the original charge ID, amount and currency. Send the proposal for review before the payment tool receives any request that could move money.
Check: Approval for one charge and amount can’t authorise an edited or replayed request.
During incident response, give an operations agent read access to logs for the affected service. Limit the scope to that incident and expire it when the investigation ends.
Check: Log collection succeeds for the assigned service. Credential rotation and access to unrelated services are denied.
