Documentation Concepts
Policy & approvals
Cella is designed to keep permission rules outside the agent. Changing the model, the prompt, or repository content does not grant more access.
Product design · implementation in progress
On this page
Declare what the work may do
Policy controls repository access, runtime limits, Connections, Channels, Run Targets, protected effects, and required approvals. Rules come from trusted, versioned sources and are evaluated independently of the model.
The agent can request an action. It does not get to authorize its own request.
Every applicable layer must allow it
The effective policy is the intersection of the security floor and the applicable organization, Project, Workstream, Cell, and operation rules. A lower layer can narrow access; it cannot widen a higher layer.
A denial wins. An approval does not override a denial or remove the security floor. Untrusted repository content may propose configuration, but it cannot approve itself.
Read the policy hierarchyGrant an operation, not a credential
A Connection binds an authorized external identity outside the Agent Cell. The Gateway performs allowed typed effects using that identity, without handing reusable credentials to the agent.
Project Secrets may be projected to an authorized Service Cell. That does not give the Agent Cell permission to read them. Service observations and artifacts follow their own policy and redaction rules.
Connections and the GatewayApprove the exact consequence
For actions requiring approval, the decision binds to the exact operation, parameters, target, policy, candidate digest, and deadline. Changing the candidate or action means the prior decision does not authorize the new request.
| Requested action | Authority required |
|---|---|
| Edit the private candidate | Admitted workspace permissions |
| Call the app’s test endpoint | A named, scoped Channel |
| Deliver a repository change | A typed effect and any required exact approval |
| Override an organization denial | Refused; a lower layer cannot grant it |
Effects have identity and reconciliation state. If a connection drops, the controller must determine what happened before retrying an action.
Make the decision inspectable
Policy decisions, denials, approvals, commands, boundary events, and effects belong in attributable evidence. A reviewer should be able to connect a delivered change to the rules and checks that applied.
Signatures protect integrity and producer identity. They do not make an agent’s assertion true. Missing observations remain explicit gaps.
Read the evidence contract