REFERENCE · §2 · LAST REVIEWED 2026-04-27

ACF §2 — Action Perimeter

The action perimeter is the explicit, enforced boundary around what an autonomous agent is permitted to do — implemented through tool whitelists, scoped permissions, value caps, jurisdiction filters, and pre-execution approval gates — beyond which the agent must defer to a human operator.

Models are non-deterministic. A perimeter that lives only in the prompt is an ambition, not a control. The Action Perimeter section defines the technical (tool registry, capability tokens, scoped service accounts) and policy (value caps, jurisdiction filters, customer-class restrictions) layers that must enforce limits independent of the model. Maps to EU AI Act Article 14 (human oversight), Article 15 (accuracy & robustness), and the operational-resilience requirements of MiCA Article 68 and FCA SYSC 4.

Regulatory anchors

• EU AI Act Art. 14-15
• MiCA Art. 68
• FCA SYSC 4
• NIST AI RMF Manage 4.2
• ISO 42001 §8.4

What this covers

• Tool registry and tool-call whitelisting per agent class
• Per-session value caps and aggregate daily caps
• Jurisdiction filtering: what the agent can do in which licensed scope
• Pre-execution approval gates for actions exceeding thresholds
• Adversarial input handling — prompt injection containment

Common gaps

• Perimeter is described in the system prompt only — no enforced control
• No daily aggregate cap; agent could execute 1,000 in-bounds actions and breach in aggregate
• Approval gates exist but have a default-allow timeout
• Prompt injection through customer-supplied input never tested

Related sections

• §1 — Identity & Authorisation

  Who or what is permitted to take action; how authorisation flows to agents and is revoked.

• §3 — Audit Trail

  Every agent action logged with sufficient detail to reconstruct intent and outcome.

• §4 — Reversibility

  Capability to unwind agent-mediated actions within a defined window.

• §6 — Performance Monitoring

  Drift, hallucinations, and other performance regressions that produce regulatory breaches.

Reference compiled by Sebastian Heine. Editorial perspective at The SHeine Brief.