Write down what it should do, what it may touch, where it may publish. Annex runs it and records everything.
One question crossing Finance and People.
The interesting part is the last step. The agent had the budget, the plan, and the band — everything it needed. It refused, because the offer tool requires named approvals from Finance and People. That precondition lives in the tool, so no amount of confident reasoning gets around it.
Memory arrives with its scope and origin attached, and the agent cites it by index. When it says $1.2M is left, you can see which memory said so and who published it.
A new-hire coordinator isn’t an HR agent or a Finance agent. It lives in the seam between them — which is exactly where back-office work breaks, and the part no department’s own tool ever owns.
An agent is a row, not a deploy: namespace, prompt, write scopes, tools.
Calls a tool, reads the result, decides what's next — up to a turn cap.
Only the tools its template names. Injection can't reach for new capability.
The offer drafter refuses without both approvals on the record.