Nishit9

Question on the cross-user case, which I don’t think the memory partitioning answer upthread fully covers. Say the agent pulls a deal record under the CEO’s grant and writes a summary into a shared Slack channel. Later a contractor’s session reads that channel and emails the summary somewhere. Every call passes on its own, since the contractor is allowed to send email. Does the policy engine know anything about where an argument came from, like which grant originally fetched it, or only who’s calling and which endpoint? I ask because I’ve been building something that tracks where send destinations first showed up, and it’s noisy. In my testing it also denied sends where the user typed the address themselves, because the same address was in tool output.