What an agent cannot do

Some actions are deliberately out of an agent's reach, whatever the phrasing used:

• making the bot leave a server;
• touching the token or identity of a custom bot;
• sending an arbitrary test message in a channel.

These are not oversights. They are actions whose consequences are immediate, public or irreversible, and which must remain an explicit human decision.

What requires confirmation

Tools whose effect is public and immediate are annotated as such, and a well-configured agent will ask you for confirmation before calling them:

• publishing a ticket panel or a role menu in a channel;
• publishing a giveaway announcement;
• closing or rerolling a draw;
• deleting a panel, a menu, an agent or a knowledge source.

Validation identical to the dashboard

An agent cannot write a configuration the dashboard would refuse: the bounds and allowed values are exactly the same on both sides. An out-of-range value is clamped to the limit, or refused with an explicit message.

Isolation

A tool never receives a raw server identifier: the server is resolved and authorised before any access to data. An agent can only act on the servers its owner administers.

Migrating from another bot

The migration tools drive the migration, they do not apply it. An agent can start a scan and read its report, but applying it remains an explicit approval by the administrator in the dashboard.