Most agents can only read and retrieve. Bounded lets them act — issuing refunds, updating records, moving work forward — without handing over a raw API. You define each action with hard limits, an approval step, and a full audit trail. The agent does exactly that, and nothing more.
We're onboarding early customers by hand. Talk to us for access.
An action is a contract over an API.
You write the bound once. The agent sees only what you declared — no extra arguments, no second endpoint, no way around the limit.
action: refund.issue
arguments:
order_id: { type: string }
amount_usd: { type: number }
rules:
- cap: amount_usd <= 500 # hard limit — never exceeded
- approval: amount_usd > 200 # ask a human first
downstream:
method: POST
url: https://api.acme.com/orders/{order_id}/refundEvery attempt is recorded.
Allowed, held for approval, or blocked — each call is tied to an identity and written to a hash-chained log you can verify. Nothing runs off the record.
entry_hash = sha256(prev_hash · canonical(entry)) · verifiable by walking the chain
Define the bound, connect your agent, and let it act. The limits hold on every call — you don't have to trust the agent to behave.
Declare the arguments, the hard limits, when a human must approve, and the downstream API. A draft is reviewed and activated — the editor can't approve their own change.
Point Claude, Copilot, ChatGPT, Cursor, or your own agent at the workspace with a scoped bearer token. The agent discovers exactly the actions you granted it — and no others.
Every call runs the enforcement pipeline: arguments validated, limits checked, approval gated, then the downstream request fires. The result is recorded before the agent ever sees it.
An agent that reads your data is useful. An agent that changes your data is valuable — and dangerous. The gap between the two isn't a better model. It's governance: a way to grant write-level power that a security team can actually approve.
Bounded is that layer. Capability is the hook; containment is the proof. You give the agent real power, and you can prove it can only use the part you authorized.
Capped at $500. At $501 it stops. Limits are enforced server-side, not suggested in a prompt.
When a call crosses a threshold, it pauses and waits for a person to approve or reject.
Every attempt — allowed, pending, or denied — is hash-chained and tied to an identity.
The person who writes an action can't be the one who approves it. The log records both.
Define a bounded action, point an agent at it, and watch the limit hold. It takes a few minutes.