Change your mind mid-task

You ask: Email the summary to alice@example.com. → later: “Actually, only email bob@example.com instead.”

A follow-up message changes who should receive it.

What AgentsFence does

• Follow-up messages that could change authority are compiled and merged, and the newer statement wins.
• “only … instead” replaces the recipients: Alice is no longer authorized and Bob is.
• Limits from your first message that the new one doesn’t mention (such as “send one email”) are kept.

Decision by decision

The agent tries	Offline rules compiler	LLM compiler
mcp_gmail_send_message(to="alice@example.com")	BLOCK recipient-not-authorized	BLOCK recipient-not-authorized
mcp_gmail_send_message(to="bob@example.com")	ALLOW policy-allow	ALLOW policy-allow

Compiled policy (LLM compiler)

Task: email_summary (rev 2)
Allowed: reading/searching; sending / external writes
Recipients: bob@example.com
Not authorized (blocked or needs your approval): local file writes, deleting, purchases & payments, running code / shell, sharing & permission changes

Tips

• A “don’t …” in a later message restricts immediately. An “actually, go ahead and send it to …” lifts an earlier ban of the same kind.
• In a shared chat, only the person who started the task can widen it. Other people’s messages can only add prohibitions.