Mobius

Bound what an agent can spend, how long it can work, what it can reach, and where a person should review its work.

Guardrails are the limits you put on an agent so that when something goes sideways it stops for a reason you can read, rather than running all night.

You'd give a new hire a company card with a limit on it. Same idea. Not because you expect trouble, but because a stuck agent at 2am should cost you nothing and leave a clear note about what happened.

The two-minute version

If you read nothing else on this page, do these three things before an agent works without a person watching:

Give it only the actions it needs. This is the strongest control on this page, and the one most often skipped.
Use connected accounts with the right controller and audience. Mobius rechecks that boundary before each provider action.
Set the routine's spending ceilings deliberately when you approve one, rather than accepting whatever was proposed.

The rest of this page is what each of those does, and where you see it working.

What each guardrail is for

The worry	What handles it	Where you see it working
This could get expensive	The routine's per-occurrence and rolling 24-hour ceilings	The occurrence ends, and its outcome says why
We could run out of credits	The organization's included allowance and per-person limits	Settings > Usage
This turn could run forever	The agent's turn timeout	The turn's terminal status and error
It could change another system	Which actions and connected accounts the agent can use, plus any review required by its instructions	The interaction, tool call, and destination record
Nobody answered a review request	The interaction's own deadline	The interaction resolves as Expired and the conversation that asked receives that outcome
The agent is going round in circles	The duplicate-tool-call breaker	The turn stops and says so

When work stops at a configured ceiling, inspect the terminal reason and the last completed model or tool call. Tighten the task if it did unnecessary work; raise the ceiling only when the expected path needs more room.

Bound what the agent can reach

An agent can only call the actions you granted it. That grant is the guardrail that operates before anything else, because a capability an agent does not have is a capability it cannot misuse under any prompt.

Give an agent the narrowest set that lets it do its job, with the narrowest provider permissions behind each one. An action's Read-only, Idempotent, and Destructive annotations describe expected behavior; they do not turn a mutating endpoint into a safe one.

When you find yourself reasoning about whether the agent will use a dangerous action carefully, that is the signal to withhold it instead. See tools and skills.

Review an external change when the workflow needs it

Mobius does not automatically pause before a built-in, MCP, custom HTTP, or worker action changes another system. Tool access and connected-account grants are hard dispatch controls: the assistant must hold the action, the selected account must remain eligible, and Mobius rechecks the exact connection before a provider call. Those checks decide whether the assistant may use a capability; they do not ask a person to approve one destination or payload.

For work that needs human judgment, tell the assistant to open an interaction and wait for the answer before it acts. The request should show the proposed content and destination, name an eligible responder, and state what the assistant must do for approval, rejection, cancellation, and expiry. This ordering comes from the assistant's instructions. Mobius does not bind the response to a later action's arguments or add another confirmation at dispatch.

A review is not a rollback and does not prove delivery. Inspect the interaction, the following tool result, and the destination system as separate records. See interactions.

Ceilings on a routine

A routine carries two ceilings:

Ceiling	What it stops
Credits per run	One occurrence, once its recorded spend reaches the limit
Credits per 24 hours	Further occurrences, once the rolling spend across the routine reaches the limit

The New routine form shows both under Advanced and projects scheduled runs over the next 30 days when it can understand the schedule. A proposal card in a conversation shows the same ceilings and 30-day maximum before approval. Event routines cannot project how many events will arrive, so choose their limits from a measured manual run and the event volume you expect.

Ceilings are enforced between operations, not in the middle of one. Mobius won't kill a model call halfway through and leave you with a half-finished mess. In practice that means an occurrence can finish slightly above its ceiling, by whichever call was already in flight, so don't set one so tight that a single extra call matters.

A clock on every turn

Every agent turn has an active-work limit: 10 minutes by default, raisable to 30. Set it on the agent under Advanced > Turn timeout.

The clock runs during model work and ordinary tool calls. It pauses after the runtime records a durable suspension, such as an event wait. A turn that waits overnight for the answer to a question uses none of its active work budget while suspended. See agent time limits for the full behavior.

Organization-wide limits

Ceilings bound one routine. The organization's credits bound everything.

Open Settings > Usage. In a direct-billed organization, the organization owner can set a default current-period credit limit for each person, apply member overrides, and see per-person usage. Other billing readers, including organization Admins, see the figures without mutation controls. In a managed organization, the service provider sets the pool and controls the shared-pool exhaustion policy.

Set a per-person default before you widen access to agents, not after. See billing and usage.

The repeat-call breaker

An agent that keeps making the exact same tool call with the exact same arguments is stuck, not working. Mobius stops that turn automatically after ten identical calls, and the transcript says why.

This one you do not configure. It exists so a loop of identical calls costs you ten calls rather than a night's worth.

What to keep an eye on

Routines that hit their ceilings. Once is informative; every day means the ceiling is wrong or the routine is.
Interactions sitting open far longer than the decision should take. Usually a person who never saw the request.
Failed turns, grouped by agent. A single agent producing most of them usually has an instruction or a tool problem, not a platform problem.
Your artifact storage, before you let an agent generate big files unsupervised.

Before you leave an agent unattended

Grant it only the actions it needs, with the narrowest provider permissions.
Bind the exact accounts and verify that each grant reaches the assistant and intended result audience.
When the workflow needs review, test approval, rejection, cancellation, and expiry, then verify that only the approved path reaches the external action.
Set the turn timeout to what the work actually needs, and no more.
Set the routine's two ceilings from a manual run, expected volume, and the 30-day projection when one is available.
Set a per-person credit limit for the organization.
Read the first few real occurrences in the transcript before widening scope.

Choose the right deadline with agent time limits.
Approve schedules and ceilings in routines.
Decide what an agent may reach in tools and skills.
Understand plan charges and credit records in billing and usage.
Put a person in the decision with interactions.

Safety and usage