> ## Documentation Index
> Fetch the complete documentation index at: https://www.plungeai.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# The fence — tools, agents, and fan-out guards

> allowedtools is a hard whitelist — only listed tools ever reach the LLM; an out-of-fence call is refused by the runtime, not merely discouraged. Omit it and one-agent offers every tool (the 8-tool default fence is universal-agent's only) — so always list the fence you mean.


<!-- sources-of-truth: agents/agents/one-agent/tools.ts (ALL_TOOLS), agents/agents/one-agent/config.ts (DEFAULT_FENCE), agents/agents/one-agent/agentic-loop.ts (fence enforcement, permissions) | last-synced: 2026-10-05 -->
## The tool fence

`allowed_tools` is a hard whitelist — only listed tools ever reach the LLM; an
out-of-fence call is refused by the runtime, not merely discouraged. Omit it and
`one-agent` offers **every tool** (the 8-tool default fence is `universal-agent`'s only) —
so always list the fence you mean.

The full loop-tool catalog (fence vocabulary): `read_file`, `write_file`,
`edit_file`, `list_files`, `search_files`, `delete_file`, `web_search`, `web_fetch`,
`load_skill`, `memory`, `knowledge`, `skill_manage`, `recall`, `recall_history`,
`delegate`, `local_agent`, `registry_search`, `registry_lookup`, `call_agent`,
`invoke_workflow`, `run_python`, `ask_user`, `platform_action`, `task_complete` — plus
the five always-on tools `schedule`, `message_bot`, `browser`, `code`, `mcp_tool_search`,
which need a saved bot (`plungeai-bot-agent`), 29 tools in all.

Fence design rules:

- **Always include `task_complete`** — it is how a run ends cleanly.
- Smallest set that can achieve the goal. A verification mission needs
  `web_search, web_fetch, task_complete` — not the file tools.
- `ask_user` keeps human-question continuations available on every surface; include
  it when the goal may need clarification mid-run.
- The loop runtime is `agent: one-agent` — always name it on the harness task (a
  harness task with no `agent:` still lands on the legacy `harness-agent` id until the
  switch-over). With no `allowed_tools` it has every tool, registry agents included
  (the thin 8-tool fence — the registry triad, `web_search`, `web_fetch`, `load_skill`,
  `ask_user`, `task_complete` — is `universal-agent`'s default). An explicit
  `allowed_tools` always narrows it.

## The agent fence and money-class protection

`call_agent` lets the loop invoke registry agents. `allowed_agents: [a, b]` limits it
to those; `'all'` opens the catalog minus `denied_agents`. **Payment/blockchain-class
agents stay deny-unless-explicitly-named even under `'all'`** — naming them is the
only way a mission can touch money, and `permissions: {call_agent: ask}` adds a human
gate on top. This is a trust fence: surface refusals, never work around them.

## Recursion and fan-out guards

- `delegate` spawns parallel child agents; children get a minimal default tool set
  and ALWAYS have `delegate`, `invoke_workflow`, and `memory` stripped — no fan-out
  explosions, no child memory writes.
- Orchestrator depth is propagated (`depth` → children send `depth+1`) and
  hard-capped (default max depth 3); a too-deep dispatch is refused.
- `max_parallel` caps one delegate call's width by refusal, never by serializing —
  silent batching would multiply wall clock.