An employee is issued its channels, its workspace and its authority as one thing. Everything it does in the world goes out through the same door, and nothing gets out without passing the check.
Each one has its own SDK, its own dashboard, its own failure modes and its own log. None of them know what the others did, and none of them know whether your agent was allowed to do it.
This is the wallet, in full. An agent can reason. An employee can reach a customer, act on their account, and be held to a limit while doing it. Everything below is issued with the employee, not bought separately afterwards.
Take the controls away and you have an agent. Leave them in and you have someone you can actually put in front of a customer.
This is the control plane, and it is the only part of the system the model does not touch. Change the limit below and run the same request again. Priya asks for the same thing every time. What happens next is not up to Priya.
Set it above ₹18,000 and the same request goes straight through. That is the only thing that changed.
This fails, and not because the model was clever enough to resist it. A customer message is information. It reaches the model as text in a database row. It never reaches the part that grants permission.
Authority lives outside the model. That is the only reason this holds.
Every agent starts in shadow mode. It does the thinking and prepares the action, and you decide whether it goes out. You move it up when it has earned it.