It asks before anything it cannot undo.
An agent holding Manage Roles is only worth having if the boundaries are real. These four are enforced in the bot rather than in the prompt, so no wording gets around them.
Four rules the bot enforces
A deletion is approved one target at a time
Before Bond deletes a channel, category, role or batch of messages, it shows the exact target it resolved and waits. The approval is bound to those Discord IDs, so agreeing to delete one channel never lets Bond delete a different one later in the same run. Allowing the tool permanently does not stand in for that approval either.
Bond cannot act beyond your own permissions
Every action is checked against the permission you hold and against role hierarchy, and reads only return what you can already see. Bond never widens a role or grants itself access to make one of its own steps succeed.
Opening a channel to everyone is its own decision
Giving @everyone access it does not already have, or clearing a deny that was keeping a channel private, raises a separate confirmation. Allowing the tool permanently does not satisfy that one, because the risk is in the target rather than in the tool.
The summary matches what happened
Bond re-reads security-relevant changes after making them and reports the real counts, failures included. When no write succeeded it tells you nothing changed, instead of describing the plan it had in the past tense.
Bond can only do what the person asking can do
There is no second set of permissions to reason about. Bond borrows yours for the length of one request, and hands back anything it could not do.
What your Discord permissions allow
You, in this server
What Bond will do when you ask, exactly the same set
Reads, edits and creations it carries out and then reports back
Deletions and @everyone access: it stops and asks
The second band is never wider than the first. When Bond is blocked it says so and asks you to grant it, rather than granting itself anything.
One thing Bond cannot do
Bond does not hold Discord's Message Content intent, so it cannot read the text of ordinary messages.
A !rank prefix command is impossible for it. Flow creation rejects any rule that tries to match on message text, rather than letting you find out months later that it never fired.
Ask for a slash command instead. You get autocomplete, typed arguments and per-role access, and members stop guessing the prefix.
How custom slash commands workWhat we store
Tool permissions you have granted per server
Server subscription status and token pack balances
Daily usage counts for rate limiting
Payment history, transaction IDs rather than payment details
Conversation history, so follow-up messages, memories and dashboard chat work
The full list, and how to have it deleted: Privacy Policy
Every rule above applies on the free plan too.
They are enforced in the bot, not asked for in the prompt.