Mobius

Bound what an agent can spend, how long it can work, what it can reach, and where a person should review its work.

Guardrails are the limits you put on an agent so that when something goes sideways it stops for a reason you can read, rather than running all night.

You'd give a new hire a company card with a limit on it. Same idea. Not because you expect trouble, but because a stuck agent at 2am should cost you nothing and leave a clear note about what happened.

The two-minute version

If you read nothing else on this page, do these three things before an agent works without a person watching:

Give it only the actions it needs. This is the strongest control on this page, and the one most often skipped.
Use connected accounts with the right controller and audience. Mobius rechecks that boundary before each provider action.
Set the routine's spending ceilings deliberately when you approve one, rather than accepting whatever was proposed.

The rest of this page is what each of those does, and where you see it working.

What each guardrail is for

The worry	What handles it	Where you see it working
This could get expensive	The routine's per-occurrence and rolling 24-hour ceilings	The occurrence ends, and its outcome says why
We could run out of credits	The organization's included allowance and per-person limits	Settings > Usage
This turn could run forever	The agent's turn timeout	The turn's terminal status and error
It could change another system	Which actions and connected accounts the agent can use, and the assistant's approval setting	The approval card, tool call, and destination record
Nobody answered a review request	The interaction's own deadline	The interaction resolves as Expired and the conversation that asked receives that outcome
The agent is going round in circles	The duplicate-tool-call breaker	The turn stops and says so

When work stops at a configured ceiling, inspect the terminal reason and the last completed model or tool call. Tighten the task if it did unnecessary work; raise the ceiling only when the expected path needs more room.

Bound what the agent can reach

An agent can only call the actions you granted it. That grant is the guardrail that operates before anything else, because a capability an agent does not have is a capability it cannot misuse under any prompt.

Give an agent the narrowest set that lets it do its job, with the narrowest provider permissions behind each one. An action's Read-only, Idempotent, and Destructive annotations describe expected behavior; they do not turn a mutating endpoint into a safe one.

When you find yourself reasoning about whether the agent will use a dangerous action carefully, that is the signal to withhold it instead. See tools and skills.

Ask before an action changes another system

Each assistant has an approval setting in its tools settings:

Don't ask. Calls run as soon as the assistant makes them.
Ask before actions that can't be undone. Sends, calendar invites, posts, deletes, and remote tools that are not marked read-only wait for a person. New assistants start here.
Ask before any change. Every call that is not read-only waits.

The setting covers tools that reach a connected account or a remote server. Computer tools count too, because the computer can reach the internet and use the assistant's GitHub access: running a command or a coding agent can't be undone, and cloning, fetching, or copying files is a change. MCP, custom HTTP, and worker tools set their own marks, so Mobius treats them as able to cause harm unless they are marked read-only. Tools inside Mobius, such as memory, the Library, and tables, never ask.

When a call waits, the person the work is for sees an approval card in the conversation. In a routine, its responsible people or its owner see it. The card shows the account, the recipients, the message, and every other argument. Approve runs the call and lets the assistant use the same tool again without asking for the rest of that message, or that routine run. Decline stops the call and the tool for the rest of that message. A card nobody answers expires after 24 hours, and a new message from the person ends it without a decision.

Approving grants no extra access. Mobius still rechecks the tool, the account, and the grant before the call runs, and the call runs on the account the card showed or not at all.

For a review the approval setting does not cover, such as a judgment about whether to act at all, tell the assistant to open an interaction and wait for the answer before it acts. The request should show the proposed content and destination, name an eligible responder, and state what the assistant must do for approval, rejection, cancellation, and expiry. This ordering comes from the assistant's instructions. Mobius does not bind the response to a later action's arguments or add another confirmation at dispatch.

A review is not a rollback and does not prove delivery. Inspect the interaction, the following tool result, and the destination system as separate records. See interactions.

Ceilings on a routine

A routine carries two ceilings:

Ceiling	What it stops
Credits per run	One occurrence, once its recorded spend reaches the limit
Credits per 24 hours	Further occurrences, once the rolling spend across the routine reaches the limit

The New routine form shows both under Advanced and projects scheduled runs over the next 30 days when it can understand the schedule. A proposal card in a conversation shows the same ceilings and 30-day maximum before approval. Event routines cannot project how many events will arrive, so choose their limits from a measured manual run and the event volume you expect.

Ceilings are enforced between operations, not in the middle of one. Mobius won't kill a model call halfway through and leave you with a half-finished mess. In practice that means an occurrence can finish slightly above its ceiling, by whichever call was already in flight, so don't set one so tight that a single extra call matters.

A clock on every turn

Every agent turn has an active-work limit: 30 minutes by default, raisable to 60. Set it on the agent under Advanced > Turn timeout.

The clock runs during model work and ordinary tool calls. It pauses after the runtime records a durable suspension, such as an event wait. A turn that waits overnight for the answer to a question uses none of its active work budget while suspended. See agent time limits for the full behavior.

Organization-wide limits

Ceilings bound one routine. The organization's credits bound everything.

Open Settings > Usage. In a direct-billed organization, the organization owner can set a default current-period credit limit for each person, apply member overrides, and see per-person usage. Other billing readers, including organization Admins, see the figures without mutation controls. In a managed organization, the service provider sets the pool and controls the shared-pool exhaustion policy.

Set a per-person default before you widen access to agents, not after. See billing and usage.

The repeat-call breaker

An agent that keeps making the exact same tool call with the exact same arguments is stuck, not working. Mobius stops that turn automatically after ten identical calls, and the transcript says why.

This one you do not configure. It exists so a loop of identical calls costs you ten calls rather than a night's worth.

What to keep an eye on

Routines that hit their ceilings. Once is informative; every day means the ceiling is wrong or the routine is.
Interactions sitting open far longer than the decision should take. Usually a person who never saw the request.
Failed turns, grouped by agent. A single agent producing most of them usually has an instruction or a tool problem, not a platform problem.
Your artifact storage, before you let an agent generate big files unsupervised.

Before you leave an agent unattended

Grant it only the actions it needs, with the narrowest provider permissions.
Bind the exact accounts and verify that each grant reaches the assistant and intended result audience.
When the workflow needs review, test approval, rejection, cancellation, and expiry, then verify that only the approved path reaches the external action.
Set the turn timeout to what the work actually needs, and no more.
Set the routine's two ceilings from a manual run, expected volume, and the 30-day projection when one is available.
Set a per-person credit limit for the organization.
Read the first few real occurrences in the transcript before widening scope.

Choose the right deadline with agent time limits.
Approve schedules and ceilings in routines.
Decide what an agent may reach in tools and skills.
Understand plan charges and credit records in billing and usage.
Put a person in the decision with interactions.

Safety and usage