Agents

An agent in BRAIAN is a configured worker that performs process steps. It combines a model, a defined set of tools, a scoped machine identity and the policies attached to it. Agents hold no standing credentials of their own: access is issued per run and expires with the run.

View as markdown

Agent configuration

An agent declares what it can use, not what it should try. Anything outside the declared tool list is unreachable, regardless of what the model generates.

finance-agent.yaml

name: finance-agent
model: braian-reason-1
identity: svc-finance-agent
tools:
  - sap.purchase_orders.read
  - sap.invoices.post
  - erp.vendor_master.read
policies:
  - finance.payment-threshold
  - data.residency-ch-eu
max_steps: 24

Identity and credentials

Each agent maps to one machine identity in the control plane, never to a human account.
Credentials are minted per run, scoped to the declared tools, and revoked when the run ends.
Secrets are stored encrypted and are never returned to the model context.

Limits on autonomy

Agents are bounded by a step budget, a tool scope and the policies attached to them. When a bound is reached the run does not fail silently: it escalates with the full context of what was attempted.