Reading only what the agent may read

The quality of an agent's draft depends on what it read. So does the safety of letting it draft at all. An agent that can read anything on the site will sometimes read the wrong thing, and an agent that reads from material the site did not intend to share has already caused a problem before it writes a word. On Czar, reading is bounded, local, and visible.

The version says what may be read

When an operator draws an agent in Agency Studio, one of the things they draw is which material the agent may read. That might be a particular set of policy documents, a procedures manual, the history for a certain class of account, or a collection the site has prepared for this desk. Whatever it is, it goes into the published version as one of the agent's bounds.

The bound is not advisory. Material outside it is not available to the agent during a run. There is no prompt that can talk the agent into reading something else, because the agent's access is defined by the version and not by what the packet says. If the desk later needs the agent to read more, the operator draws that, publishes a new version, and the stable address is pointed at it. The change is deliberate and recorded.

Retrieval happens on the appliance

The agent reads through Substrate's retrieval capability, which runs on the Czar appliance. The corpus stays wherever the customer placed it. The appliance retrieves over the site's documents in place, finds the passages relevant to the packet, and hands those passages to the drafting step.

Nothing about this requires the corpus to be copied out of the building. There is no upload to a vendor's index. There is no outside service that holds a shadow of the site's documents. A fully air-gapped site retrieves exactly the way a connected one does, because retrieval never needed an outside connection in the first place.

Passages, not the whole corpus

Within its bounds, the agent does not read everything. It reads what the packet calls for. A claim against a particular policy pulls that policy's relevant clauses and the account's prior history. A request of a particular type pulls the procedure for that type. Retrieval narrows the agent's reading to the passages that bear on this run.

This matters for drafting quality. A draft built from a handful of relevant passages is grounded in those passages. A draft built from an entire manual tends to blend things that should stay apart. The agent on Czar drafts from what it retrieved, and the operator can see during design whether the retrieval is bringing back the right material.

The reviewer sees what was read

At the waiting step, the reviewer sees the draft and the passages it was drawn from. This turns the review from a judgment about text into a judgment about evidence. The reviewer can check that the clause the agent cited is the clause that applies, and that the history it referenced belongs to the right account.

The same passages go into the run record. Someone who opens a finished run tomorrow sees the packet, the passages, the draft, the decision, and the call as one sequence. The article The run record and what it holds describes that record in full.

Why bounded reading is a governance matter

Bounding what an agent may read is a governance decision, not only a quality decision. A site may have material that one desk should see and another should not. A site may have material that no agent should read at all. Writing the reading bound into the version means these decisions are made once, by the operator and the admin, and hold for every run of that version.

It also means the decision is inspectable. An auditor who asks what an agent could have read for a given period gets an answer from the published version that was live, not from a reconstruction of configuration. Bounds written into the version covers the other bounds that sit alongside this one.

A site that puts an agent on Czar knows three things about its reading. It knows which material the agent could reach, because the version says so. It knows the reading happened on the appliance and the corpus stayed where it was. And it knows, for every run, which passages the agent actually used, because the reviewer saw them and the record kept them. That is enough to let the agent read freely within its bounds. The platform page describes the retrieval capability the agent relies on.