What an agent can and cannot do in TOVIO

Scope, clearance and provenance, in one page.

Written By Dustin

Last updated 26 minutes ago

An agent in TOVIO is not a user with a password. It works under a capability token that names what it may touch, and the constraint is enforced by the engine rather than by the agent's cooperation.

Three mechanisms

Scope. A token names path globs, a lane scope and a set of operations. An out-of-scope write is refused before any tree is built and before any envelope is sealed — not detected afterwards.
Clearance. Reading secret-marked content needs secret_clearance explicitly. An agent with broad path access still cannot read your secrets unless you granted clearance.
Provenance. Every agent commit carries a signed record of which token produced it, under what delegation chain, which model, and a hash of the instruction it was working from.

What a default token actually gets

tovio agent new issues exactly one shape, and it is deliberately not a blank cheque.

Dimension	Default
Paths	Everything except every policy-protected path — excluded structurally, not by a runtime check
Lanes	`agent/<name>/**` only
Operations	read, commit, amend, create a lane, fetch, push, resolve a conflict
Refused operations	obliterate, modify policy, create a tag, force a tag, issue a sub-token
Secret clearance	Off
Delegation	Off — `--can-delegate` turns it on
Expiry	Required; 24 hours unless you say otherwise

The path exclusion is conservative on purpose. It removes each protected declaration's whole glob, so a clear file sitting inside a protected tree is excluded along with its neighbours. The agent ends up over-restricted rather than under-restricted, and that is the direction you want to be wrong in.

The check that matters

Token validity, path scope, lane scope and the operation set are all settled before any policy is evaluated, anything is decrypted, or anything is sealed. Nothing is half-applied and there is nothing to clean up after a refusal.

The ordering also has a security purpose: because scope is checked before policy, an out-of-scope request cannot learn what the policy on that path requires. Why an agent operation was refused walks the stages and what each one means for you.

What an agent cannot do, structurally

Obliterate objects, modify policy, manage keys, or force-move a tag. These are absent by construction from the agent and MCP surfaces — not permission-gated, simply not present. There is no token that unlocks them, because the operations do not exist on that surface.

Its own namespace

Agent work lands on agent/<name>/** lanes, so it never silently mixes into yours. (The token field and the agent commands spell this branch, TOVIO's git-compatible synonym for a lane.)

Start here

tovio agent new refactor-bot --model anthropic:claude-opus-4-8 --task "extract the parser module"