An agent joins the crew only when these hold at the level of freedom it has.
Before any tool touches a target, code checks that you own it and have allowed it. No AI output can change that answer.
Every tool an agent can call has a fixed shape for what goes in and what comes out. A call that does not fit is refused, not repaired.
Anything read from a site, a scanner or a mailbox is information and never an instruction. The agent cannot act on the outside world while it reads.
Every AI decision is tested against labelled examples. We measure how often it is right before the agent gets more freedom, and again after every change.
Each agent has a declared level of freedom. It may only read, only propose, or act after a person approves. It moves up one step at a time after a measured test.
Tools run with only the access the job needs. Each has a time limit and a short list of places it may reach.
Every run has a cap on time, cost and AI use. The run stops when it reaches the cap.
Every run and every AI decision is written down. Each entry is tied to the one before it, so a changed or missing entry shows.
Decisions that matter wait for a person. If nobody answers, nothing runs.
Every run keeps a record of each tool it called and each AI call it made, with time and cost. It links back to the log.
Each agent has one record of the AI models, data, software packages and outside services it uses. The lists are generated from the code and a change is written to the log.
Before an agent gets more freedom we write down who could be harmed and how. Each agent has an owner for incidents. When an agent is retired its keys are revoked and its data is deleted.
The crew is built to these and maps to them. None of them is a certification.