Running agents

What an agent can see, what it can do, and what it leaves behind.

15 min Owner: Security Updated 13 Sep 2026 v1.3

Scope is declared, not prompted

An agent reaches the sources on its list and nothing else. Not the ones it can name, not the ones it can guess, not the ones a clever instruction talks it into. Scope is enforced when the query runs, below the model, so prompt injection cannot widen it.

In the console: Policies

Ward AI drafts, you approve

Describe the job in plain English and Ward AI proposes the agent and the permissions it would need. The proposal sits there until a human approves it. Nothing runs on a draft.

In the console: Policies

Write actions

An agent that can only read is a reporting tool. An agent that can act needs a grant per action, and each one leaves an audit record naming the agent, the person who approved it and the rows it touched.

In the console: Policies

Bring your own model

Providers is where you point Ward at Anthropic, OpenAI, Google, or an endpoint inside your own VPC, on your own keys. The policy and audit layer is identical either way, which is the part that survives you changing your mind about models.

In the console: Providers

In the console

The screens this guide walks through, captured from a running tenant.

app.getward.ai

A Cedar policy open in Ward’s editor, permitting the viewer role to query the sales.store_sales_daily model when the region is WE, with unit_cost, margin and extended fields marked hidden. — **Policy editor.** Row scope and hidden fields in five lines, with autocomplete over your own models and errors underlined as you type.

Ward’s Policies list for the Acme tenant: eight Cedar policies, seven permitting and one forbidding, each with an inline edit control. — **Policies.** Access is eight Cedar policies you can read in a sitting, not a permissions matrix nobody opens.

Ward’s access log: every authorization decision recorded for the tenant, timestamped to the second in UTC, with outcome, action, resource, actor, and the milliseconds each decision took. — **Access log.** Every authorization decision, allowed or denied, with the actor and the latency. This is the page the security review asks for.

Ward’s Providers page: OpenAI, Anthropic, Google, Azure OpenAI, Groq, OpenRouter, xAI, Mistral and Ollama, each showing how many models it exposes and whether it has been configured. — **Providers.** Nine providers, your keys. On this tenant only Ollama is configured, running local.

Ward’s Model Profiles table: four provider-and-model pairs that agents, chats and dashboards route through, including Qwen 3.8 on llama.cpp, DeepSeek v4 Flash, and GLM 5.3 marked as the default. — **Model profiles.** One table decides which model answers. Change the default and every agent follows it.

PreviousConnecting sources NextSemantic layer