Agents see only what they should
Access rules enforced in the kernel, not in prompts. Every denial names its reason, and an agent acting for you never gets more access than you have.
import json
from cambrian_agent_sdk import CognitiveAgent
class FinanceAgent(CognitiveAgent):
role = "Prepares month-end summaries from the finance share."
def run(self, task):
res = self.substrate.execute_tool(
"read_file", json.dumps({"path": "2026-09/ledger.csv"}))
if res["denied"]:
# A denial is data, not an exception.
return {"error": f"Access refused: {res['deny_reason']}"}
return self.think(task)Rules your agents cannot argue with
Tag-based access
Documents and tools carry tags. An agent’s scope says which tags it may read, and the kernel filters every result before it is returned.
No grant, no tool
Agents start with no tools. An operator grants each one, and can bind it to a resource policy, such as the folders it may read.
Least privilege, delegated
An agent acting for you gets the overlap of your scope, the surface, its own scope, and tool policy. No layer can widen it.
Every denial explained
A refusal names its reason and the tag or policy behind it, so you can fix the rule instead of guessing.
Secure by design, not by checklist
Cambrian has no certifications yet. What it has is an architecture where access is enforced in the kernel, every decision is explained, and you run it yourself.