A prompt is not a perimeter. Telling an agent "never touch production" shapes behavior but enforces nothing. The Agent Access Model puts the boundary outside the model with real controls that run at the point of action, scoped to the task at hand. https://blog.cloudflare.com/the-agent-ac…