# Hiring, agent configuration, and organization — agent access Product map: [Hiring, agent configuration, and organization](../feature-map/agents.md). Review date: 2026-10-12. Source commit: `58e16dbddfc9c8d0cf60867f9d9847f0feda055b`. Native REST transport reconciled in this change; see the [shared transport contract](README.md#native-rest-transport). This is a source-reviewed baseline of representative operations and known gaps. Each capability needs operation-level review before its entire scope can be qualified. No live agent execution is claimed. Follow the [map contract](../README.md) for format, permission checks, evidence and maintenance. ## `hire` Review: `baseline`. API: `present` — representative operation IDs: - `POST /api/companies/{companyId}/agent-hires`. - `POST /api/companies/{companyId}/agents`. Agent access: `partial` — Native hire_agent; REST / CLI agent; runtime inheritance for native hires. Policy: Agent creation/configuration uses action grants, resource policies and change consent; some controls require a board actor. Evidence: `source-only` — [implementation](../../server/src/routes/agents.ts#L1395) at the reviewed commit above. Verification: `not-run` — exercise a listed permitted operation with actual agent credentials/run context; inspect its result and applicable persistence/attribution. Assert the relevant denied actor, owner, company or mode from Policy. Review the remaining operations before qualifying the whole capability. Gaps: Identity/persona hiring works. Operator account login and sensitive adapter/environment configuration are separate guarded actions. ## `instructions` Review: `baseline`. API: `present` — representative operation IDs: - `GET /api/agents/{id}/instructions-bundle/file`. - `PUT /api/agents/{id}/instructions-bundle/file`. Agent access: `available` — Native read/update/history/restore instruction tools; REST / CLI. Policy: Agent creation/configuration uses action grants, resource policies and change consent; some controls require a board actor. Evidence: `source-only` — [implementation](../../server/src/routes/agents.ts#L1395) at the reviewed commit above. Verification: `not-run` — exercise a listed permitted operation with actual agent credentials/run context; inspect its result and applicable persistence/attribution. Assert the relevant denied actor, owner, company or mode from Policy. Review the remaining operations before qualifying the whole capability. Gaps: Canonical entry file, revision guard, company boundary, and protected-change policy apply. ## `organization` Review: `baseline`. API: `present` — representative operation IDs: - `GET /api/companies/{companyId}/org`. - `PATCH /api/agents/{id}`. Agent access: `available` — list_agents/get_agent; native call_api for permitted configuration fields; REST / CLI. Policy: Agent creation/configuration uses action grants, resource policies and change consent; some controls require a board actor. Evidence: `source-only` — [implementation](../../server/src/routes/agents.ts#L1395) at the reviewed commit above. Verification: `not-run` — exercise a listed permitted operation with actual agent credentials/run context; inspect its result and applicable persistence/attribution. Assert the relevant denied actor, owner, company or mode from Policy. Review the remaining operations before qualifying the whole capability. Gaps: Reporting-line changes need configuration authorization; a title alone gives no authority. ## `lifecycle` Review: `baseline`. API: `present` — representative operation IDs: - `POST /api/agents/{id}/pause`. - `POST /api/agents/{id}/resume`. - `POST /api/agents/{id}/terminate`. Agent access: `partial` — REST / native `call_api` resume under agent_config:update change-grant authorization; pause and termination remain board-only. Policy: Agent creation/configuration uses action grants, resource policies and change consent; some controls require a board actor. Evidence: `source-only` — [implementation](../../server/src/routes/agents.ts#L1395) at the reviewed commit above. Verification: `not-run` — exercise a listed permitted operation with actual agent credentials/run context; inspect its result and applicable persistence/attribution. Assert the relevant denied actor, owner, company or mode from Policy. Review the remaining operations before qualifying the whole capability. Gaps: Resume has a generic native REST path. Pause and termination remain enforced actor restrictions. ## `built-in` Review: `baseline`. API: `present` — representative operation IDs: - `POST /api/companies/{companyId}/built-in-agents/{key}/provision`. Agent access: `partial` — REST / native fallback for eligible provisioning; built-in routine controls require board. Policy: Agent creation/configuration uses action grants, resource policies and change consent; some controls require a board actor. Evidence: `source-only` — [implementation](../../server/src/routes/agents.ts#L1395) at the reviewed commit above. Verification: `not-run` — exercise a listed permitted operation with actual agent credentials/run context; inspect its result and applicable persistence/attribution. Assert the relevant denied actor, owner, company or mode from Policy. Review the remaining operations before qualifying the whole capability. Gaps: Provisioning checks agents:create. Enabling/running its built-in routine is not the same permission path. ## `primary-agent` Review: `baseline`. API: `present` — GET and PUT /api/companies/{companyId}/primary-agent/me. Agent access: `restricted` — this is the authenticated human's personal preference. Agent keys and native call_api use agent identity and are denied by the board gate; no dedicated agent selection tool is present. Policy: Requires board user identity, company access and active membership, except implicit-local board or instance administrator. Viewers may choose their own primary. Selection requires a same-company readable, available agent and is scoped to actor user ID; the request cannot select another user's preference. Explicit null selection is rejected; leave/termination can clear an unavailable choice. Initialization stays recorded so clearing does not silently replace it. Evidence: `source-only` — reviewed on 2026-10-13 at `60bc0d5fee9a6e48db08fc016521fee3d9f57d67`: [routes](../../server/src/routes/primary-agent.ts), [service](../../server/src/services/primary-agent.ts), [provider](../../ui/src/context/PrimaryAgentProvider.tsx), and [route tests](../../server/src/__tests__/primary-agent.test.ts). Verification: `not-run` — select and read the preference as two company users; assert isolation, wrong-company/unreadable targets, pending/terminated agent rejection and agent-key denial. Verify replacement confirmation and fallback precedence in the UI; inspect the cleared state after permitted leave/termination. Gaps: No agent mutation path for another person's preference. Live human/agent access is unverified; UI fixture callbacks do not establish persistence or task and Chat default resolution.