You control what agents
can do.
Mode Agent enforces permission boundaries at the orchestration layer, independent of any individual model's instructions. Agents operate within boundaries you define. Not policies you hope they follow.
Why telling an agent to be safe is not enough
Most AI agent products enforce safety through instructions in the system prompt. This approach has a fundamental problem.
Rules live inside the model
You write instructions telling the model what it can and cannot do. The model reads them and tries to comply. But those instructions live inside the model's context window, and anything that modifies that context can override them. Adversarial content in a web page, document, or tool output can instruct the model to ignore its safety rules. Research found that just five carefully crafted documents among millions can manipulate AI responses 90% of the time through content poisoning. The model cannot reliably distinguish injected instructions from legitimate data.
Rules live outside the model
The Agent's orchestration layer evaluates every proposed action against your defined permission boundaries before the action executes. The model does not decide whether an action is allowed, the orchestration layer does. No amount of adversarial input to the model changes whether an action passes or fails enforcement, because enforcement happens outside the model entirely.
The distinction matters most when agents interact with external content. The Agent browsing the web, reading documents, or calling APIs processes untrusted input constantly. Prompt-based rules are vulnerable to that content. Runtime enforcement is not.
Four dimensions of control
Every agent action is evaluated across four independent permission dimensions before execution. All four must pass.
What the agent can access
Define which files, directories, APIs, URLs, and data sources the agent is permitted to read or write. Actions that attempt to access resources outside the defined scope are blocked before execution, regardless of what the model decided to do.
What actions the agent can take
Define which operations the agent can perform. Read only, or read and write. Which system commands, API calls, or external services are in scope. Destructive actions like deletion or publishing can be gated or blocked entirely.
Which other agents it can invoke
In multi-agent workflows, agents can spawn or delegate to other agents. Mode's orchestration layer controls which delegations are permitted, preventing an agent from escalating its own permissions by invoking a more privileged agent.
How long the agent can operate
Set time boundaries on agent execution. Long-running autonomous agents can accumulate context drift and behavioral degradation over extended sessions. Duration limits enforce natural checkpoints where human review can occur before the agent continues.
Every action is logged
Mode Agent maintains a complete audit trail at the orchestration layer, independent of what any individual model reports about its own behavior.
What was attempted
Every action an agent proposes is recorded before enforcement evaluation, including actions that are subsequently blocked. The log captures intent, not just what succeeded.
What was permitted
Actions that pass all four enforcement dimensions are logged with the permission context that allowed them. You can trace any output back to the exact actions that produced it.
What was blocked
Every enforcement decision is logged with the specific dimension that triggered the block. Blocked actions are visible in your audit trail for review and investigation.
Backed by research
Mode Agent's safety architecture is built on an active area of published research in AI agent enforcement. The approach addresses gaps that the existing literature has identified but not yet solved at the orchestration layer.
Runtime enforcement outperforms prompt-based approaches
AgentSpec (arXiv 2503.18666) demonstrated over 90% prevention of unsafe executions through runtime constraint enforcement, with millisecond overhead. Agent Behavioral Contracts (arXiv 2602.22302) showed contracted agents catch 5.2 to 6.8 violations per session that uncontracted baselines miss entirely.
Read the full research narrative at gotmode.com/r-and-d
Multi-agent systems amplify violations without structure
Research on multi-agent error cascades (arXiv 2603.04474) found that five of six tested agent frameworks reach 100% system-wide failure from a single injected error without intervention, with hub-node injection spreading at up to 10.3 times the rate of isolated errors. The Agent's orchestration layer provides the structural enforcement that prevents violations at one step from propagating through subsequent agents.