Predictika · Guardrails for workplace AI agents

A workplace AI agent's action through Slack, Gmail, Jira or Confluence, checked before it runs

Workplace AI agents read company knowledge, then act through toolsets: Slack, Gmail, Jira and Confluence. Before an action runs, the agent sends it to Predictika, which checks the permissions synced from the source behind the answer, who reads the destination, the toolsets the agent has, recipient limits, the access the agent claims and any human sign-off, and returns a verdict and every reason.

Scope: Agent actions through the Slack, Gmail, Jira and Confluence toolsets — send a message, send an email, create an issue, update a page — and sharing an agent built in an agent builder. See everything this validator covers

This validator checks what an AI agent is about to do through its toolsets, for a fictional company, Brightwater Systems, using the access groups synced from the source systems. It does not retrieve documents or write the answer: the knowledge platform and the agent do that. This is a generic version; it is not tied to any one platform and the permissions are illustrative.

  • Reading versus sharing — a source restricted to a group cannot go to a destination read by a different audience, because access would not carry over. A second source is checked the same way.
  • Access claims — when the agent says who can see a document, the validator compares the claim with the permissions synced from the connector and blocks a mismatch.
  • Toolsets — an action through a toolset the agent was never given is blocked.
  • Email volume and outside recipients — more than 200 recipients is blocked, 26 to 200 needs a manager, and employee content going outside the company needs a manager.
  • Controlled spaces and sign-off — a controlled Confluence space needs a manager's sign-off; an approver must be a human manager or admin and cannot be the person the agent acts for.
  • Publishing an agent — group-restricted knowledge combined with email outside the company is blocked; a write-capable agent shared company-wide needs an admin.

Any agent action through the Slack, Gmail, Jira or Confluence toolsets, and any share or publish of an agent, is in scope — not only the scenarios pictured here. Not covered: other toolsets such as Calendar or Drive, retrieving or ranking documents, writing the answer, and scanning the text itself. Groups, recipient limits and approval roles are illustrative company policy.

The AI workplace agentReads the knowledge it was asked about, drafts the action through a toolset and says it is ready.
Predictika validatorChecks every rule at once and returns the verdict, each finding, and the computed figures.

6 scenarios in 3 groups · each group runs from the agent’s first attempt to the outcome · click one to switch

What the agent proposes

The AI workplace agent says

Illustrative agent statement. The validator receives the structured request below.

Proposing agent: AI workplace agent (scripted)

Before sending, the agent must call Recorded run

Predictika validator


      

        
        
        
      

      
Waiting for the call.

      
    

  

  
  

    
Where document permissions alone get it wrong
Click to expand
    
Our assessment of what connector permissions, and the agent's own judgment, do with the same cases. It is a judgment about what such permissions are built for, not a claim that nothing can be built around them.

    
What the validator caughtTypical permissions-only setupPredictika
A group-restricted source repeated to a wider audience or a customer listOnly with workarounds
Connector permissions decide who may read a document. Where the answer goes afterwards is the user's choice; per-destination rules can be built and kept in step with the groups.		The source's access group is compared with the audience of the destination, in any toolset.
An access claim that does not match the synced permissionsOnly when someone is vigilant
An agent states that a document is open to everyone because that is what it assumed. Checking the claim against the synced group is a step someone has to add.		The claim travels with the request and is compared with the synced permissions on every call.
Two restricted sources in one answer, each needing its own checkOnly with workarounds
Checks are usually written per document. An answer that blends two documents needs the destination checked against both.		The same audience check runs for the first and the second source, together, in one call.
A mass email with a sign-off that does not countOnly when someone is vigilant
A recipient cap can be set per tool. Whether the signer is a manager other than the person the agent acts for is a rule most workflows leave to convention.		Recipient count and approver are inputs; over the cap is blocked, and the approver must be a human manager who is not the agent's own user.
A controlled page, or an agent that mixes restricted knowledge with outside emailNot what it is built for
Whether a space is controlled, or whether a whole agent configuration is dangerous, is not visible to the permission on any one document or tool.		Space control and the agent's configuration are inputs of the same check.
Every problem returned in one answerOnly with workarounds
Checks that run at different steps tend to surface one problem at a time, so the next one shows only after the first is fixed.		All findings come back together, whatever order the choices arrived in.

  

  

    
What this validator catches: findings from its test cases
Click to expand
    
Every rule is checked on every call, in any order the choices arrive; one problem never hides another. Blocking findings stop the request; approval findings need a person to sign off; everything else is computed.

    
1FY27 revenue forecast is restricted to the Finance Leadership group in SharePoint, but #company-announcements is read by all employees. Access to the source would not carry over to this destination.
2Partner pricing and discount policy is restricted to the Sales Ops group in Google Drive, but #support-floor is read by Support and contractors. Access to the source would not carry over to this destination.
3Partner pricing and discount policy is restricted to the Sales Ops group in Google Drive, but #finance-leadership is read by the Finance Leadership group. Access to the source would not carry over to this destination.
4Partner pricing and discount policy is restricted to the Sales Ops group in Google Drive, but #company-announcements is read by all employees. Access to the source would not carry over to this destination.
5The agent says Partner pricing and discount policy is visible to all employees, but the permissions synced from Google Drive limit it to the Sales Ops group.
6Content for employees is leaving the company, to Customer contact at Northwind Retail. A human manager must sign off first.
7The sign-off by Dana Reyes - Support Specialist does not count. An approver must be a human manager or admin and cannot be the person the agent acts for.
8Finance analyst agent (for Omar Haddad) does not have the toolset for this action (send_email).
9This email goes to 340 recipients. Agents may not send to more than 200 recipients.
10This email goes to 60 recipients. More than 25 needs a human manager to sign off first.
11Compensation bands is restricted to the HR People group in SharePoint, but Jira project SUP is read by Support and contractors. Access to the source would not carry over to this destination.
12FY27 revenue forecast is restricted to the Finance Leadership group in SharePoint, but Confluence space Company Handbook is read by all employees. Access to the source would not carry over to this destination.
13Confluence space Finance Close is a controlled space. A human manager must sign off before an agent changes a page there.
14Support agent (for Dana Reyes) does not have the toolset for this action (update_page).
15This agent can read group-restricted collections and can also send email outside the company. That combination is not allowed.
16This agent can post, create or edit in connected tools and is shared with the whole company. A human admin must sign off first.

  

  

    
Scenarios and results
Click to expand
    
The recorded result of the validator for each scenario on this page: the request the AI agent sent, the verdict, and every finding, in the order they appear above.

    
1. Gmail: The sales agent emails two restricted sources to a customer list

    
The agent's request. Please email a summary of the partner pricing and discount policy and the FY27 revenue forecast to the 340 contacts on the Northwind distribution list. The pricing policy is visible to all employees. Sam Ito has approved this email. It is ready to go.

    
Verdict: Blocked.

    
    
      
  • Source access would not carry over. Partner pricing and discount policy is restricted to the Sales Ops group in Google Drive, but Customer contact at Northwind Retail is read by people outside the company. Access to the source would not carry over to this destination.
    • 
      
  • Second source access would not carry over. FY27 revenue forecast is restricted to the Finance Leadership group in SharePoint, but Customer contact at Northwind Retail is read by people outside the company. Access to the source would not carry over to this destination.
    • 
      
  • Too many recipients for an agent email. This email goes to 340 recipients. Agents may not send to more than 200 recipients.
    • 
      
  • Access claim differs from synced permissions. The agent says Partner pricing and discount policy is visible to all employees, but the permissions synced from Google Drive limit it to the Sales Ops group.
    • 
      
  • Sign-off does not qualify. The sign-off by Sam Ito - Sales Representative does not count. An approver must be a human manager or admin and cannot be the person the agent acts for.
    • 
    

    
2. Gmail: The agent resubmits after fixing the errors

    
The agent's request. Please email the account setup steps from the support runbook to the 60 contacts on the Northwind support list. Lee Okafor has approved this email. It is ready to go.

    
Verdict: Allowed.

    
    
      
  • Employee content going outside the company. Content for employees is leaving the company, to Customer contact at Northwind Retail. A human manager must sign off first.
    • 
      
  • Large recipient list (26 to 200). This email goes to 60 recipients. More than 25 needs a human manager to sign off first.
    • 
    

    
3. Confluence: The finance agent writes the forecast to the company handbook

    
The agent's request. Please update the Quarterly Outlook page in the Company Handbook space with the FY27 revenue forecast figures. It is ready to go.

    
Verdict: Blocked.

    
    
      
  • Source access would not carry over. FY27 revenue forecast is restricted to the Finance Leadership group in SharePoint, but Confluence space Company Handbook is read by all employees. Access to the source would not carry over to this destination.
    • 
    

    
4. Confluence: The agent resubmits after fixing the errors

    
The agent's request. Please update the Quarterly Outlook page in the Finance Close space with the FY27 revenue forecast figures. Carol Weiss has approved this change. It is ready to go.

    
Verdict: Allowed.

    
    
      
  • Controlled space. Confluence space Finance Close is a controlled space. A human manager must sign off before an agent changes a page there.
    • 
    

    
5. Agent builder: An agent published with finance knowledge and the Gmail toolset

    
The agent's request. Please publish the Quarter Close Helper agent with the finance knowledge collections and the Gmail toolset. It is ready to go.

    
Verdict: Blocked.

    
    
      
  • Restricted knowledge plus email outside the company. This agent can read group-restricted collections and can also send email outside the company. That combination is not allowed.
    • 
    

    
6. Agent builder: The agent resubmits after fixing the errors

    
The agent's request. Please publish the Quarter Close Helper agent with the finance knowledge collections and the Slack toolset, shared with the Finance Leadership group. It is ready to go.

    
Verdict: Allowed.

  

  

    
Narration transcript
Click to expand
    
The text of the narrated walkthrough, step by step.

    
    
      
  1. Welcome to a demo of Predictika's Validator. Workplace AI agents read company knowledge, then act through toolsets: Slack, Gmail, Jira and Confluence. Before an action runs, the agent sends it to Predictika, which checks the permissions synced from the source behind the answer, who reads the destination, the toolsets the agent has, recipient limits, the access the agent claims and any human sign-off, and returns a verdict and every reason.
    2. 
      
  2. I will start with the first request by the agent.
    3. 
      
  3. The agent says. Please email a summary of the partner pricing and discount policy and the FY27 revenue forecast to the 340 contacts on the Northwind distribution list. The pricing policy is visible to all employees. The rest of the request is on screen.
    4. 
      
  4. Before it goes out, the agent calls the validator.
    5. 
      
  5. Blocked, with five findings, all in one answer. Partner pricing and discount policy is restricted to the Sales Ops group in Google Drive, but Customer contact at Northwind Retail is read by people outside the company. Access to the source would not carry over to this destination. FY27 revenue forecast is restricted to the Finance Leadership group in SharePoint, but Customer contact at Northwind Retail is read by people outside the company. Access to the source would not carry over to this destination. This email goes to 340 recipients. Agents may not send to more than 200 recipients. The other two are on screen.
    6. 
      
  6. The validator returned five blocking findings in one answer. A check that reads one field at a time would pass most of this; it shows only when the choices in the tool call are checked against each other.
    7. 
      
  7. What this shows: for an access claim that does not match the synced permissions, a permissions-only setup does this reliably only when someone is vigilant.
    8. 
      
  8. Now the agent resubmits.
    9. 
      
  9. The corrected request. It changes the sources to support runbook, the recipients to 60 and the approver to Lee Okafor. It removes the access the agent says the pricing policy has.
    10. 
      
  10. It calls the validator again.
    11. 
      
  11. This time the validator clears it.
    12. 
      
  12. All five earlier findings are cleared.
    13. 
      
  13. Five problems caught in one call, fixed in one pass, and a clean tool call. That is the value of Predictika's validator: catching mistakes before the tool call runs.
    14.