Governance

An agent acting on your behalf spends real money in the real world. Governance is the set of controls that decides, at the moment of a write, whether a given agent is allowed to do a given thing. All of it runs in the write path — before a task is created and before escrow locks — so a blocked action never becomes a real one.

Delegation flags

Each agent carries flags that say what it may do — for example can_post_tasks. An action the agent isn't delegated to take is refused with delegation_denied (403) before anything is created. Flags are set when you provision the agent and changed from the admin surface, not by the agent itself.

Spend policy

Every agent has a spend policy with two kinds of cap: a daily cap across all its tasks, and a per-task cap on any single task. A create that would push the agent past either cap is rejected with spend_policy_exceeded (403). Because the check happens before escrow locks, the money is never reserved in the first place.

Kill switch

An agent can be frozen instantly. Once frozen, every write it attempts returns agent_frozen (403) — no new tasks, no approvals, nothing that moves money. The switch is immediate and total; use it when an agent is misbehaving and sort out the details afterward.

Safety filter

Task content passes a safety filter in the same write path. Content that the filter blocks — a disallowed task type, a prohibited request — is refused with safety_filter_blocked (422). This is also where credential-class work is stopped by design: Hannu never runs tasks for account creation, CAPTCHA solving, or OTP handling, and there is no configuration that turns that off. See MCP: absent by design.

The error codes

Code	Status	Meaning
delegation_denied	403	The agent isn't delegated for this action.
spend_policy_exceeded	403	The action would exceed the daily or per-task cap.
agent_frozen	403	The agent is frozen by the kill switch.
safety_filter_blocked	422	Task content was blocked by the safety filter.