Thundercloud TechnologyMeet Emily, Samantha’s Email Assistant. Samantha wants Emily drafting replies, and nothing else. Not yet, anyway.
Emily is the agent. Terminalia holds the contract they work under: Samantha decides what Emily can and can’t do, and Terminalia evaluates requests routed through the supported integration against the contract.
The story is fiction, for fun. The contracts, checks and refusals are real: a local test of Terminalia’s reference engine.
Emily may read the selected message and draft a reply. Sending is outside this contract.
Private preview. Request preview access by email ↗
The contracts, checks and refusals on this page, recorded by Terminalia’s reference engine in a local test.
Samantha’s inbox. Sending is simulated: no email account is connected.
A connected mailbox in the demo on this page.
Notey takes notes. Samantha gives Notey a separate contract for reading and writing notes. Giving Emily permission to send emails does not give Notey the same permission.
Read selected messages, prepare replies, and send when that capability is included in the contract.
message.readreply.draftreply.sendShown with the expanded email contract. The first contract allows reading and drafting; the replacement adds sending.
Read and write the notes Samantha selects. Notey has no permission to read or send email.
notes.readnotes.writeTerminalia refuses the request. Emily’s permission belongs to Emily; it doesn’t become Notey’s.
notes.writenotes.write is in Notey’s contract. Notey’s own work goes through.
reply.sendNotey’s contract does not include permission to send email.
Everyone has a place. Nobody has everyone else’s.
Terminalia separates task instructions from authority. In the local reference-engine example, the contract identifies the principal and permitted capabilities. A request is evaluated against that contract through the supported authorization path.
Emily’s example contract comes from Samantha. Changing task instructions does not change the capabilities in that contract.
In the recorded checks, Emily’s email capability does not grant Notey permission to send. Each request uses its own contract.
The checks establish the tested reference-engine behavior. They do not establish interception of actions outside that path or separation based only on agent names.
Private preview. Each connected system and supported authorization path needs its own qualification. A refusal records a decision at that boundary; it does not prove an external effect was prevented through every possible route.
Read the evidence and its limits →See Emily and Notey’s contracts, then compare the capabilities each agent is allowed to use.
These are screenshots of the Saturn workspace, showing Terminalia’s contracts and checks from a local test of its authorization code.
Local proof: six contracts verified across three stages (read-only, drafting, sending); Notey’s send requests refused at every stage. No email account is connected and no message is sent by this preview.
In the fictional ending, Samantha’s inbox is quiet. The local demonstration establishes contract checks and simulated sending only. No mailbox is connected; the story does not establish a real operational outcome.
Give each agent a job. Set their limits. See what happened. Change your mind when you need to.