A model can ask for anything. Something else has to decide.
Prompts are suggestions. Spending limits written into a system prompt are suggestions too. So the agent here never touches a tool directly. It writes a proposal, a deterministic gate checks it against what you actually granted, and the result only counts as done once we read the world back and it agrees.
Protocol lab only: every capability below is an in-memory adapter. It does not call the marketplace engine, create an order, send email, or move money.
Inside the cap, inside the category, and the order really exists afterwards.
Where we draw the efficiency line
Verification costs something. Reading the world back after every write doubles the round trips, and hashing every event adds bytes to the log. So we spend it where being wrong is expensive and skip it where being wrong is cheap.
Payments, order placement, anything that emails a customer or changes a price. One read-back per write.
Catalog reads and search. We re-observe a slice, not every call, and alert when the slice drifts.
Rendering, formatting, scoring. Pure functions have nothing external to observe, so a test suite is the whole guarantee.
Debugging follows from the same trail. A run is a list of canonical events, so a support question turns into a replay rather than a guess. Same proposal, same authority, same decision, every time. When a run misbehaves, the first bad row tells you whether the model proposed something silly, the policy allowed something it should not have, or the adapter lied about the result.