Most people wire up an agent and then discover what it can do. I wrote the permissions first, while I was calm, because I wouldn't be calm later. Every capability sits at one of three levels, and the agent consults the board before any protected action.
Change any of those, then ask the agent to do something.
What this is actually demonstrating
Try setting Send a DM to green and asking it to message someone. It still refuses — because on this system the messaging function was never built. That's the distinction the title is making: a policy file says what an agent may do, and a policy file can be argued with. (To be exact: two channels do carry one narrow, templated first-contact acknowledgement, governed by policy rather than by absence — the publishing paths above have no messaging function at all.) A capability that doesn't exist can't be prompt-injected, can't be talked around, and survives a compromised agent, a bad inference and a malicious instruction equally.
The board is real. It governs agents I actually run, and the levels above are the ones they're actually set to. The one lesson that cost me something: my own rules lived in a file the agent could edit. Now they're mounted read-only — it can read its permissions and cannot change what "permitted" means.
The honest limit
None of this makes an agent safe. It bounds the blast radius when the agent is wrong, which is a different and more achievable goal. It also can't stop the first bad action in a category you left open — only the second. I found that out by leaving one open.