# Agent permissions and controls | Oxagen

Source: https://oxagen.sh/product/mandates

# Mandates

Set the rules for actions routed through Oxagen. Each agent works under its own identity, permissions, toolbelt, steering, and budget, and together those terms make up its mandate.

[Follow work from its source to its outcome](https://oxagen.sh/#demo)[Read the product overview](https://oxagen.sh/product)

The Bug fixer agent's mandate. Security owns its access, Finance owns its budget of $20 a run with $11.64 spent, Engineering owns its tools, and Oxagen keeps the record of 412 frames. A request to read the repository is allowed by a rule.

One agent's mandate

**Bug fixer**Mandate billing-fixes

*   **Access**SecurityAsks for GitHub when the task needs it
*   **Budget and rules**Finance$11.64 of $20 this run
*   **Equipment**Engineering`get_issue``create_pull_request``run-tests`
*   **Record**Oxagen412 frames recorded

Request**Read oxageninc/product**Allowed by rule repo.read

Illustrative Each clause names the team that owns it

01

## Controls on routed calls

An agent with a standing token can merge to main at 3 a.m., and the team finds out when the deploy breaks. When a call is routed through Oxagen, a rule your team wrote answers it first. The rule allows the call, denies it, or routes it to a named person, and a denied call does not reach the tool.

Oxagen checks those terms on calls routed through it and records each decision, so the people who set the limits can see how they applied.

02

## Mandate features

*   [
    
    ### Identity and access
    
    Each agent has its own identity and asks for access when a task needs it.
    
    ](https://oxagen.sh/product/mandates/identity)
*   [
    
    ### Tools and skills
    
    The tools an agent can see and the skills it may load.
    
    ](https://oxagen.sh/product/mandates/tools-and-skills)
*   [
    
    ### Budgets and stops
    
    Spend ceilings and the controls that stop a run.
    
    ](https://oxagen.sh/product/mandates/budgets)

03

## Parts of a mandate

What each part sets and how it changes
| Part | What it sets | How it changes |
| --- | --- | --- |
| Access | The consequences the agent may act on, with an expiry | A grant by a person who holds the organization role the workspace names for each consequence |
| Budget | Limits on what the agent may spend and how many calls it may make | An update to the mandate's limits |
| Rules | Whether a routed call is allowed, denied, or sent to a person | The workspace's decision rules |
| Tools | The tool patterns the agent may call | A grant names patterns that must match a declared tool |
| Steering | The instructions a run reads when it starts | A reviewed steering pull request |

04

## Where controls apply

### In scope

*   Tool calls and model calls that pass through Oxagen's hooks or its local gateway.
*   Agent requests checked against the agent's own role and its delegation ceiling, on every plan.
*   Observe mode, where Oxagen records what the policy would decide and lets the call go ahead. Budget and model limits still apply to model calls routed through Oxagen.

### Out of scope

*   Actions the agent's computer never reports to Oxagen.
*   Cursor's model calls, which go to Cursor's own servers, so budget limits on model calls do not reach them.
*   Asking a person on harnesses that cannot hold a call. Codex and Cursor get a denial with the reason instead.

## Related pages

*   [
    
    ### Identity and access
    
    Each agent has its own identity
    
    ](https://oxagen.sh/product/mandates/identity)
*   [
    
    ### Tools and skills
    
    Toolbelts and MCP servers per agent
    
    ](https://oxagen.sh/product/mandates/tools-and-skills)
*   [
    
    ### Budgets and stops
    
    Spend ceilings and run stops
    
    ](https://oxagen.sh/product/mandates/budgets)
*   [
    
    ### Runs
    
    The record each agent run leaves
    
    ](https://oxagen.sh/product/runs)
*   [
    
    ### Security
    
    Agent identity and recorded decisions
    
    ](https://oxagen.sh/roles/security)

## Product walkthrough

Review the authority, tools, and budget for one supported agent.

[Follow work from its source to its outcome](https://oxagen.sh/#demo)[Read the product overview](https://oxagen.sh/product)