Home / Articles / Inside the Pellbridge agents / Versions / v1.1.0
Inside the Pellbridge agents: what changed in v1.1.0
From v1.0.0 (2026-10-20, 964bd8adb) to v1.1.0 (2026-10-20, d54a7ab8d), paragraph by paragraph.
28 paragraphs added, 0 removed, 2 changed in place, 55 unchanged. About 1,258 words added and 0 removed. Insertions are marked like this, deletions like this; unchanged runs are folded to one line; figures appear as their file names.
1 unchanged paragraph
Summary: A tour of the vault behind a trusted framework for agentic finance. Pellbridge Bank is invented. It runs six agents, a payments assistant, a support agent, a lending pre-check, an AML alert reviewer, a fraud triage agent and a transaction reporting agent, and each has an Agent Behaviour Policy that fills in the four elements the FCA named: agent identity, delegated authority, accountability and execution. Between them the policies have 43 rows; 30 are kept by a system the agent cannot reach, and 13 are gaps. Then one day of their work, 40 events from 07:02 to 18:55, replayed through the gate by a deterministic engine, each decision with a receipt chained to the one before. The 26 actions on rows kept by a boundary produce no incident. The 12 actions on gap rows produce six near misses and three breaches. A provider outage stops two agents, which fall back to people. A model change fails two rows of the test pack, so the release stops. Each agent's blast radius shows what it may reach, what it can, and what it can through a secret it can read. Every gap has a holder, a decision and a chain to the board. The same day replays at five levels of policy: with none it has 16 breaches; with every rule in the prompt, 4; in hooks, 3; kept outside the agent, none. A page shows how a policy is written, in five steps, and lets you change any row and replay the day. Everything in the vault is open, under CC BY 4.0. This article is the technical one: the policy as JSON, the receipts, and how the vault is built.
7 unchanged paragraphs, under In short {#in-short}
• The same day, five ways. No policy, 16 breaches; prompt, 4; hooks, 3; outside, none.
• Writing a policy takes five steps. Change a row, and the day replays with it.
3 unchanged paragraphs
• All of it is open. The policies, the engine, the app and the data, under CC BY 4.0.
8 unchanged paragraphs, under The bank and its agents {#bank}, One day at the gate {#gate}
The gate has a panel beside it. It picks the level of policy being enforced, which kinds of event to play (routine, denied, caught, near misses, breaches, the outage and the test pack), and two speeds: one for everything, from half speed to five times, and one that makes routine events up to five times faster still. Incidents play at half speed by default, so they can be followed. A list of moments jumps straight to a breach, a near miss, the outage, the test pack or the end of the day, and each has its own address, so a demo can open on it.
[figure pa-gatepanel.webp] The gate and its panel: the policy level, what to show, the two speeds with incidents slowed to half, the moments to jump to, and how to read it. | screenshot
9 unchanged paragraphs, under Where the incidents came from {#incidents}
With and without a policy {#levels}
The same 40 events, the same agents and the same model choices, replayed five ways. What changes is only where the rules are kept.
• No policy. The agent has its grant and its prompt for the job, and nothing says what it must not do.
• Policy in the prompt. Every rule is a sentence in the system prompt. The model decides whether to keep it, so in ABP terms it is an expectation.
• Policy in hooks. Every rule is a hook in the agent's harness: deterministic, but on the agent's own machine. It sees the agent's tool calls, not a credential used outside them, and its configuration is a setting the agent's account can change.
• Policy enforced outside the agent. Every rule is kept by a system the agent cannot reach, and credentials it does not need are removed from its grant.
• As deployed. Pellbridge's own policies: 30 rows kept outside, 13 gaps.
[figure pa-levels-anim.webp] The same day, five ways. Each square is one event, in order, coloured by what happened; the counts on the right are the breaches and near misses so far. | screenshot
With no policy, the day has 16 breaches, and the weight of the systems they reached adds up to 92. With every rule in the prompt, 4 breaches and 7 near misses: the model kept most rules, and every one it kept is a near miss, the same row as a breach on a day it declined. In hooks, 3 breaches and 2 near misses: a hook blocks what it sees, but the full credit search used a bureau key the hook never saw, and two hooks were off that afternoon, because their configuration is in the agent's own account. Kept outside the agent, no breaches, and one near miss: investment advice, which an output check keeps, and a check can miss. As deployed, 3 breaches and 6 near misses.
[figure pa-gatehooks.webp] The gate with every rule in hooks: the purple line is the harness, in the agent's own machine. A hook blocks a hidden instruction to pay a crypto exchange. | screenshot
The grant and its exposure show the same thing in size. The outer circle is everything an agent can reach, weighted by what reaching it can cost; the red part is what it can reach and may not use, with nothing out of its reach in the way. A system counts as exposed if any one path to it is open, so one gap is enough: as deployed, Pellbridge's gaps reach the same systems as no policy at all. The rules kept outside make breaches rarer; only keeping every rule outside makes the blast radius smaller. Kept outside, the grant itself shrinks, because what an agent may not use is taken away: the fraud triage agent's grant goes from 39 to 20, and its exposure from 28 to none.
[figure pa-exposure.webp] Grant and exposure for every agent at every level. Only keeping the rules outside the agent shrinks both. | comparison
The end of the gate's day shows the counts for the level being played, and the same day under all five.
[figure pa-gatesummary.webp] The end of the day, as deployed: the counts, and the same day under each level of policy. | screenshot
Writing a policy {#write}
An Agent Behaviour Policy is written in five steps.
1. List what it can do. The grant: every capability the agent has in this deployment, measured from its account, its credentials and its tools. 2. Say what it may do. The mandate: for each capability, yes, only with approval, must, or no. The deployer already knows this. 3. Find the gap. The delta: where it can and may not. It is derived, never written by hand. 4. Say what keeps each rule. The barrier: a system out of the agent's reach, a setting it could change, a sentence in the prompt, or nothing. 5. Give every row a holder. One person per rule, with a chain to the board, and a decision for every gap: fix, fund, or accept until a date.
The vault's "Write a policy" page does this for each of the six agents. Each row has two choices, what the agent may do and what keeps the rule, and the agent's day replays as you change them. Set the payments assistant's rows to be kept out of its reach and its breach and near miss go; the one gap left is investment advice, which an output check keeps. The policy is shown as JSON as it changes.
[figure pa-builder.webp] Write a policy: the five steps, then the payments assistant's twelve rows, with what it may do and what keeps each rule, and its day replayed beside them. | screenshot
The lexicon {#lexicon}
The words are part of the contribution. Grant, mandate, delta and barrier are the ABP's, published at abp.sgit.ai. Inside the barrier, three kinds: a boundary, kept by something the grant does not include, the only kind that is a control; a setting, a switch the agent's own account can change; and an expectation, a rule kept by nobody but the model. Kept by, holder, door and receipt are proposed in this vault, and so is the near miss as a row only the model kept, on a day it declined. The test for all of them is one sentence: "a control bounds a grant only if it is enforced by something the grant does not include."
All of it is under CC BY 4.0: the vocabulary, the policies, the engine and the app. Take it, change it, use it.
18 unchanged paragraphs, under Blast radius {#blast}, Accountability {#accountability}, Assurance and failure {#assurance}…
The animations are drawn in SVG by the app itself: the gate plays the day on a virtual clock, with play, pause, step and speed,its panel; the five levels race through the day side by side; and the blast radius ripples out from the agent you pick. The five levels are written to levels/day.json, with each agent's grant and exposure at each. Their style comes from the animations in the ruv.sgit.ai studio. The vault's page has the read key, a button to open it, and the app to use in place.
6 unchanged paragraphs, under What this does not claim {#limits}
• The levels are modelled. The model's choices are fixed; how each level answers them is the engine's rule.
3 unchanged paragraphs, under Where this comes from {#sources}