NAI OS
Tool grants, not good intentions.
Back to verification (and, before that, the promise). A subagent can do exactly what its tools: line permits
and nothing else. So the guarantees are not requests politely made — they are the absence
of a capability.
| Agent | What it holds | What that makes impossible |
|---|---|---|
| email-triage | 3 Gmail tools: search, read, draft | The mail server does expose send_gmail_message and
modify_gmail_message_labels. This agent is granted neither.
It cannot send your mail, because it has no way to. |
| qonto-collector | 9 Qonto list/get tools, Read, Write, Bash | No create, approve or transfer tool is in its grant — it cannot move money.
Bash is narrowed further, by the project permission file, to
curl-ing receipts into the tax folder and nothing else. |
| newsletter-writer | Read, Write — no web tools | It cannot cite a source that was not vetted into research.md first,
because it cannot reach the web at all. |
| calendar-briefing | 2 Calendar tools, WebSearch, WebFetch | It holds no write tool of any kind. It reads, and returns a block. |
| vat-worksheet | Read, Write | It computes only from files another agent collected. It has nothing to fabricate a figure from. |
The tax agents carry a second boundary, about judgement rather than capability: they flag risks for the Steuerberater and never rule on a tax position. An ambiguous VAT line goes to “Unclassified — needs review”, never to a guessed field number.
Two MCP servers supply the outside world: google-workspace (Gmail, Calendar) and Qonto (banking). Both are user-scoped — a fresh clone gets the prompts but not the connections.
NextA skill is not an agent →