Ambient agents
Tools and sandboxes
How 8rney controls tool use, browser work, files, external messages, identity, and audit trails
Ambient agents can call tools, but they do not call them directly. Every tool request goes through the 8rney tool broker.
The broker checks workspace permissions, task autonomy, approval ceilings, identity grants, rate limits, audit logging, and sandbox routing before the tool runs.
Tool broker responsibilities#
Permission enforcement
Confirm the user, workspace, matter, and connected account allow the requested action.
Autonomy policy
Decide whether the action can run, must pause for approval, or must be denied.
Sandbox routing
Route browser automation, code execution, untrusted file transforms, and broad connector work into isolated execution.
Identity control
Decide whether the action is performed by 8rney, 8rney on behalf of a lawyer, or a connected user account.
Audit logging
Record what was requested, what was allowed, what was denied, who approved it, and what happened.
Kill switches
Support cancellation, budget limits, runtime limits, organisation policy, and anomaly review.
Tool categories#
| Category | Examples | Typical control |
|---|---|---|
| Read | Search workspace, read documents, read thread context | Usually allowed when the user has access |
| Draft | Draft memo, draft email, create table | Usually allowed without external side effects |
| Internal write | Post internal update, create internal task | May require approval depending on task policy |
| External message | Send client email, message outside counsel | Requires explicit communication authority |
| Browser action | Navigate web pages, capture sources | Routed through a sandboxed browser when needed |
| File mutation | Write, move, transform, or organise files | Routed through controlled execution and approvals |
| Destructive action | Delete, overwrite, revoke, or remove data | Requires explicit destructive authority |
| Signature or filing | E-sign, submit filing, lodge document | Requires explicit authority and high-signal audit |
| Payment or billing | Spend money, change billing, pay an invoice | Requires explicit authority and administrative controls |
Sandboxed execution#
Sandboxes isolate actions that need a stronger boundary than ordinary legal tools.
| Workflow | Runs where |
|---|---|
| Legal search, drafting, summarisation, extraction | Agent worker with brokered permissions |
| Browser automation and page capture | Per-run browser sandbox |
| Code execution and file transforms | Per-run execution sandbox |
| Untrusted document conversion | Isolated transform sandbox |
| Desktop computer use | Local Desk session with local permission controls |
Sandboxed runs can have CPU, memory, runtime, and network limits. The worker records sandbox requirements in the run events and audit trail.
Identity and external actions#
8rney keeps identity explicit:
- Internal Slack, Teams, and email updates can be sent as 8rney or as 8rney on behalf of the lawyer.
- Client-facing communication can be draft-only, sent as 8rney on behalf of the lawyer, or sent from the lawyer's connected account.
- Every external action records the destination, identity mode, task policy, approval decision, and final result.
Do not use broad autopilot authority for client messages, filings, signatures, destructive file operations, payment, or billing unless the workspace policy and task ceiling are explicit.
Audit trail contents#
An Agent Task audit trail can include:
- Original instruction
- Workspace, matter, source channel, and initiating user
- Autonomy selection and approval ceiling
- Structured policy rules
- Tool call requests and broker decisions
- Approval requests and outcomes
- Sandbox routing and limits
- External recipients and identity mode
- Artifacts created
- Final status and error messages
Why channels do not bypass safety#
Slack, Teams, Gmail, and Outlook do not execute tools directly. They send requests into the Agent Task system. The same worker, broker, approvals, identity grants, sandboxes, and audit trail apply no matter where the task started.
This is why 8rney can feel ambient without becoming uncontrolled. The channel is convenient, but the authority still lives in the task policy.