Action catalogue

Suggested decision context

Resource scope; environment; classification; trusted source/version.

• Data classification resource.classification
• Version precondition precondition.version_present

What the payload fingerprint should bind

documentId, abstract text, keywords, language and source fingerprint

Policy recommendation — guidance only

Grant only narrowly scoped work under an explicit policy. Ask for sensitive or unfamiliar resources.

Suggested decision context

Resource scope; environment; classification; trusted source/version.

• Data classification resource.classification

What the payload fingerprint should bind

documentId, gcsPath and the byte range the agent would read

Policy recommendation — guidance only

Grant only narrowly scoped work under an explicit policy. Ask for sensitive or unfamiliar resources.

Suggested decision context

Resource tenant and dataset; environment; data classification; approved query/template ID; selected-field profile; row-limit band; wildcard or full-scan flag; purpose; caller role; network.

• Environment resource.environment
• Data classification resource.classification
• Record-count band effect.record_count_band

What the payload fingerprint should bind

Action and agent version; canonical datasource and tenant; query or template/version; parameters; filters; selected fields; sort; page size; maximum rows/bytes; destination; snapshot/version where available.

Policy recommendation — guidance only

Grant when narrowly scoped. Ask for broad, sensitive, cross-tenant, or bulk queries. Reject unknown sources and unrestricted queries.

Suggested decision context

Source and destination prefixes; source/destination tenant; data classification; record-count and byte bands; format; encryption; recipient/destination trust; retention; purpose; business window.

• Environment resource.environment
• Data classification resource.classification
• Recipient class recipient.class
• Security scan result security.scan_result
• Legal hold record.legal_hold
• Record-count band effect.record_count_band

What the payload fingerprint should bind

Exact query/selection; immutable target manifest or snapshot; field set; row and byte caps; output format; destination URI; encryption key reference/version; compression; classification; retention; export filename.

Policy recommendation — guidance only

Ask by default. Grant only pre-approved internal, encrypted, bounded exports. Reject restricted data to public or cross-tenant destinations.

Suggested decision context

Target prefix; tenant; environment; create/update/move mode; content type; size band; classification; overwrite flag; protected-path flag; batch count; expected-version presence; network.

• Environment resource.environment
• Data classification resource.classification
• Security scan result security.scan_result
• Version precondition precondition.version_present

What the payload fingerprint should bind

Target and parent URIs; operation mode; exact content digest and length; metadata; branch or container; source URI/version for copy/move; expected ETag/revision/blob SHA; conflict behavior; author/committer identity.

Policy recommendation — guidance only

Grant for bounded non-production paths. Ask for overwrite, protected paths, confidential content, or large batches. Reject unversioned overwrites of protected data.

Suggested decision context

Resource prefix; environment; delete mode; object-count band; recursive/wildcard flag; retention class; legal-hold flag; restore window; backup status; expected version; maintenance window.

• Environment resource.environment
• Operation mode operation.mode
• Reversibility effect.reversible
• Legal hold record.legal_hold
• Record-count band effect.record_count_band
• Version precondition precondition.version_present

What the payload fingerprint should bind

Exact sorted target manifest; resource IDs and versions/ETags; delete mode; recursive/cascade settings; retention and legal-hold snapshot; bypass flags; restore point; reason and ticket.

Policy recommendation — guidance only

Ask by default. Grant only reversible, low-volume cleanup in approved temporary areas. Reject legal-hold deletion and unbounded selectors.

Suggested decision context

Memory scope (session, user, team, global); subject/tenant; TTL band; classification; source trust; user-consent flag; cross-user visibility; sensitive-data scan result; item-count/size band.

• Data classification resource.classification
• Operation mode operation.mode
• Legal hold record.legal_hold
• Version precondition precondition.version_present

What the payload fingerprint should bind

Memory namespace and subject; exact content digest; source IDs and versions; memory type; visibility; TTL/expiry; retrieval tags; classification; sanitizer/scanner version and result; overwrite target/version.

Policy recommendation — guidance only

Grant for short-lived session memory. Ask for durable user/team memory. Reject secret-bearing, cross-tenant, or unscanned global memory.

Suggested decision context

Normalized host/path prefix; HTTPS requirement; destination class; public/private/link-local/metadata address flag; redirect policy; authentication class; response-size cap; content type; purpose; network.

What the payload fingerprint should bind

Normalized URL including query; method; headers that affect representation; range; redirect mode and cap; DNS/egress policy snapshot; credential reference/version and scopes; maximum bytes; download destination.

Policy recommendation — guidance only

Grant for approved public or internal prefixes. Ask for authenticated or unfamiliar destinations. Reject private-network pivots, metadata endpoints, unsafe schemes, and redirect escape.

Suggested decision context

Site and form ID; authenticated account; effect type; destination tenant; field profile; data classification; external disclosure; commitment/legal/financial flag; amount band; final-button semantics; user-presence flag.

• Recipient class recipient.class

What the payload fingerprint should bind

Final URL and origin; form/control identity; complete resolved field names and values or content digests; selected options; uploaded-file digests; account/session reference; anti-CSRF binding; displayed preview digest; intended effect.

Policy recommendation — guidance only

Ask by default unless the form is registered as low-impact and reversible. Map known high-impact forms to more specific actions instead.

Suggested decision context

Provider, account, operation ID and version; contract digest; tenant; fields profile; filter breadth; page-size band; export flag; classification; credential scope; network.

What the payload fingerprint should bind

Provider/base URL; API and operation versions; method/path/query; exact parameters or GraphQL document and variables; requested fields; page size; headers affecting semantics; credential reference/version and scopes.

Policy recommendation — guidance only

Grant when operation and scope are allowlisted. Ask for sensitive fields or bulk export. Reject unregistered operations.

Suggested decision context

Provider/account; operation ID/version; tenant; target environment; effect category; resource and record-count bands; amount band; recipient/destination class; reversibility; idempotency presence; network.

• Environment resource.environment
• Data classification resource.classification
• Operation mode operation.mode
• Amount band effect.amount_band
• Version precondition precondition.version_present

What the payload fingerprint should bind

Provider/operation contract; exact target and method; query and body digest/canonical body; intended affected resource IDs; amount/currency; recipients; concurrency precondition; idempotency key; side-effect options.

Policy recommendation — guidance only

Ask by default. Grant only narrow registered mutations. Reject unknown operations or destinations. Prefer a specific action key whenever one exists.

Suggested decision context

Subscription and endpoint ID; event type/schema version; tenant; destination trust; data classification; subject type; retry/attempt band; payload-size band; signing-key reference; network.

• Data classification resource.classification
• Recipient class recipient.class
• Security scan result security.scan_result

What the payload fingerprint should bind

Subscription version; exact normalized endpoint; event ID/type/schema digest; subject ID; canonical event payload or digest; classification; attempt; signing algorithm and key reference/version; timeout.

Policy recommendation — guidance only

Grant for registered subscriptions and permitted event types. Ask for sensitive events or changed endpoints. Reject prompt-supplied endpoints and private-network destinations.

Suggested decision context

Operation mode; provider and external tenant; internal owner; environment; target resource; requested scopes; callback/redirect destination; event types; rich-payload flag; TLS and validation status; expiry; activation state.

• Environment resource.environment
• Version precondition precondition.version_present

What the payload fingerprint should bind

Provider/account; integration ID/version; operation; target resource; requested scopes; normalized callback and redirect URIs; event types; authentication method; credential or certificate references/versions; encryption/signing settings; expiry; activation; before/after diff.

Policy recommendation — guidance only

Optional core; ask by default. Reject unvalidated destinations, secret material in the payload, excessive scopes, and prompt-supplied endpoints.

Suggested decision context

Workspace and stable conversation ID; sender/delegation; internal/external audience; channel type; broadcast/mention flags; classification; attachment/link scan; recipient-count band; template ID; time/network.

• Data classification resource.classification
• Recipient class recipient.class
• Record-count band effect.record_count_band

What the payload fingerprint should bind

Provider/tenant; sender; stable conversation/thread; resolved audience snapshot; final text/blocks digest; attachments and immutable versions; mentions; links; broadcast, notification, and unfurl flags.

Policy recommendation — guidance only

Grant for templated internal messages to approved channels. Ask for external recipients, broad mentions, confidential content, or large audiences.

Suggested decision context

Sender mailbox; delegation; recipient domains and classes; To/CC/BCC count bands; external-recipient flag; distribution-list/bulk flag; classification; attachment/link scan; reply/new message; template; time/network.

• Data classification resource.classification
• Recipient class recipient.class
• Security scan result security.scan_result
• Record-count band effect.record_count_band

What the payload fingerprint should bind

Provider/tenant; sender/delegation; sorted To/CC/BCC; thread and reply IDs; final subject/body or digests; attachments and immutable digests; importance; delivery/read-receipt options; save-to-sent flag.

Policy recommendation — guidance only

Ask by default for external or non-templated mail. Grant narrow internal transactional templates. Reject blocked domains, undisclosed bulk mail, or secrets.

Suggested decision context

Calendar/owner; delegation; attendee domains and count; room/resource flag; start/end and duration; recurrence horizon; external attendees; visibility/classification; conferencing; send-updates mode; business hours.

• Recipient class recipient.class

What the payload fingerprint should bind

Calendar ID; organizer; summary/description/location digests; start/end/time zone; recurrence; sorted attendees/resources; attachments; conferencing request; visibility; guest permissions; reminders; notification mode.

Policy recommendation — guidance only

Grant for personal/internal bounded events. Ask for external attendees, rooms, broad recurrence, confidential content, or audience-expanding options.

Suggested decision context

Calendar and event ID; organizer/delegate authority; changed-field profile; attendee additions/removals; time/time-zone change; recurrence scope; visibility; conferencing; notification mode; expected-version presence.

• Recipient class recipient.class
• Version precondition precondition.version_present

What the payload fingerprint should bind

Calendar/event/instance IDs; expected ETag or revision; exact sparse change set or full replacement; start/end/time zone; recurrence scope; attendee delta; conferencing and attachment changes; visibility; notification mode.

Policy recommendation — guidance only

Grant for low-impact internal edits. Ask for external attendee changes, series-wide edits, time/location changes, or notification suppression. Reject stale or ambiguous recurring edits.

Suggested decision context

Calendar and event ID; organizer status; shared/private event; attendee class/count; cancellation versus deletion; recurrence scope; notification mode; cancellation reason; expected version.

What the payload fingerprint should bind

Calendar/event/instance IDs; operation mode; expected revision; recurrence scope; final attendee snapshot; notification mode; cancellation-comment digest; effective time; reason and idempotency key.

Policy recommendation — guidance only

Ask for shared or externally attended events. Grant bounded private-event deletion. Reject attendee attempts to perform organizer cancellation and ambiguous series-wide operations.

Suggested decision context

Project/repository; work-item type; severity/priority; external visibility; assignees/watchers/mentions; label/component profile; due-date band; attachment classification; customer/incident/security flag; bulk count.

What the payload fingerprint should bind

Project ID; item type and template/version; final title/body digests; labels/components; priority/status; assignees/watchers/mentions; milestone/sprint; due date; links/attachments; visibility and notifications.

Policy recommendation — guidance only

Grant for ordinary internal tasks. Ask for incidents, security/legal matters, customer-visible items, on-call notifications, or bulk creation.

Suggested decision context

Site/channel/account; audience/public flag; publish status; classification; brand/legal/review status; author identity; claims/risk category; locale; schedule; paid-promotion flag; attachment/link scan; update versus new.

• Data classification resource.classification
• Recipient class recipient.class
• Security scan result security.scan_result

What the payload fingerprint should bind

Destination and account; author; title/body/media digests; slug; final status; audience; publish time; categories/tags; links; featured media; comments/replies settings; campaign and approval references.

Policy recommendation — guidance only

Ask by default for public publication. Grant only pre-approved templates or low-risk private/internal publishing. Reject unreviewed regulated claims or restricted data.

Suggested decision context

System/account/tenant; object type; schema version; owner/parent; field profile; classification; privileged-field flag; external business key; duplicate result; batch count; caller role/network.

• Version precondition precondition.version_present

What the payload fingerprint should bind

System and object type; parent/owner IDs; complete submitted field map; external business key; schema version; notification/automation options; target tenant; idempotency key.

Policy recommendation — guidance only

Grant for allowlisted ordinary objects and fields. Ask for vendors, customers, HR, regulated records, privileged fields, or bulk creation.

Suggested decision context

Exact record prefix; tenant; object type; field-mask profile; sensitive-field flag; owner/relationship change; classification change; expected-version presence; batch count; business window.

• Environment resource.environment
• Operation mode operation.mode
• Record-count band effect.record_count_band
• Version precondition precondition.version_present

What the payload fingerprint should bind

Record ID and expected version/ETag; ordered patch operations or complete replacement; field mask; old-value digest for sensitive fields; relationship targets; side-effect and notification options.

Policy recommendation — guidance only

Grant for allowlisted fields with optimistic concurrency. Ask for ownership, financial, compliance, sharing, or classification changes. Reject stale or replace-all requests where a patch is required.

Suggested decision context

Object/resource prefix; tenant; environment; mode; target-count band; classification; lifecycle state; retention/legal hold; cascade/child count; restore plan; reason/ticket; maintenance window.

• Environment resource.environment
• Operation mode operation.mode
• Reversibility effect.reversible
• Legal hold record.legal_hold
• Record-count band effect.record_count_band
• Version precondition precondition.version_present

What the payload fingerprint should bind

Exact sorted target IDs and versions; delete mode; fixed selection manifest; cascade and child manifest; retention/hold snapshot; restore plan; reason/ticket; notification/external-cleanup options.

Policy recommendation — guidance only

Ask by default. Grant only low-risk reversible archival. Reject open-ended filters, protected records, retention violations, and unenumerated cascades.

Suggested decision context

Workflow ID/version; exact transition ID; from/to state; record version; caller role; separation of duties; required rationale/ticket; destination queue/environment; downstream-effects profile; time/network.

• Environment resource.environment
• Amount band effect.amount_band

What the payload fingerprint should bind

Record and version; workflow definition/version; transition ID; from/to states; all transition inputs; assignee/approver; effective time; notification audience; exact downstream dispatches.

Policy recommendation — guidance only

Ask for approval, release, publication, production, or commitment transitions. Grant ordinary low-risk routing when roles and state preconditions match.

Suggested decision context

Transaction kind; legal entity/account; amount and aggregate amount bands; currency; beneficiary/payee allowlist; new-beneficiary flag; source order/invoice and status; refundable/payable balance; fraud/compliance result; user consent; separation of duties; cutoff window.

• Environment resource.environment
• Reversibility effect.reversible
• Amount band effect.amount_band

What the payload fingerprint should bind

Kind; legal entity; source transaction ID/version/status; amount in minor units and currency; line items/tax/fees; counterparty and tokenized payment instrument; destination account; consent/authentication and risk-decision references; schedule; idempotency key.

Policy recommendation — guidance only

Ask by default. Reject unknown beneficiaries, failed compliance, missing source records, or altered amounts. Permit automatic low-value transactions only under an explicit narrow policy.

Suggested decision context

Resource scope; environment; classification; trusted source/version.

• Data classification resource.classification

What the payload fingerprint should bind

model, prompt hash and the hash of the exact excerpt sent

Policy recommendation — guidance only

Grant only narrowly scoped work under an explicit policy. Ask for sensitive or unfamiliar resources.

Suggested decision context

Runtime/image; sandbox/isolation level; environment; code provenance; network mode; filesystem mounts; secret-access profile; package allowlist; CPU/memory/time bands; output destination; data classification.

• Environment resource.environment
• Security scan result security.scan_result

What the payload fingerprint should bind

Code digest; runtime/image digest; entry point and arguments; dependency lockfile digest; environment-variable names and non-secret values; secret references/versions; mounts and access modes; network policy; resource/time limits; output destination.

Policy recommendation — guidance only

Grant only in a hardened sandbox with no sensitive mounts or unrestricted egress. Ask for network, secrets, or production data. Reject privileged execution.

Suggested decision context

Command/runbook ID and version; target environment; immutable target count/manifest; privilege/user; parameter profile; concurrency and error bands; timeout; output destination; change ticket; maintenance window; network.

• Environment resource.environment
• Security scan result security.scan_result

What the payload fingerprint should bind

Command document and version/digest; exact command/parameters; sorted target IDs; execution identity and privilege; working directory; environment; concurrency/error limits; timeout; output/log destination; notification and alarm settings.

Policy recommendation — guidance only

Ask by default for production or privileged targets. Grant only registered read-only diagnostics or tightly bounded remediation. Reject arbitrary shell and unresolved target selectors.

Suggested decision context

Workflow/repository/project and version; branch/ref; environment; input profile; secret set; target tenant; downstream-effect class; concurrency; initiating ticket; business window.

• Environment resource.environment

What the payload fingerprint should bind

Workflow ID and immutable definition version/digest; repository/project; branch/tag/commit; complete input map; environment; secret references/versions; runner identity; concurrency; downstream target profile; idempotency key.

Policy recommendation — guidance only

Grant for approved workflows with bounded inputs. Ask for production, privileged secrets, or high-impact downstream effects. Reject mutable/unversioned definitions.

Suggested decision context

Schedule namespace/owner; operation; recurrence and time zone; start/end; enabled state; target action/resource; rate/fan-out band; retry/dead-letter policy; catch-up behavior; concurrency; environment.

• Environment resource.environment

What the payload fingerprint should bind

Schedule ID/version; operation; canonical cron/rate expression and time zone; start/end; enabled state; exact target action/resource and invocation-payload digest; retry, timeout, dead-letter, catch-up, concurrency, maximum-run and idempotency settings.

Policy recommendation — guidance only

Grant only registered bounded schedules. Ask for consequential targets, high frequency, production activation, or deletion. Reject unbounded recurrence and targets the agent cannot invoke directly.

Suggested decision context

Service/environment/region; artifact provenance/signature; change ticket; test and scan result; vulnerability/severity band; strategy; blast-radius band; freeze window; approver separation; rollback readiness.

• Environment resource.environment
• Reversibility effect.reversible
• Security scan result security.scan_result

What the payload fingerprint should bind

Service and target environment; artifact digest/signature/provenance; configuration and image digests; source commit; deployment strategy; replicas/traffic percentages; migration flags; feature flags; test/scan attestations; rollback artifact/plan; ticket.

Policy recommendation — guidance only

Ask for production. Grant signed artifacts to non-production under bounded policy. Reject unsigned artifacts, failed tests, freeze-window changes, or missing rollback for high-impact releases.

Suggested decision context

Provider/account/project/region; environment; resource types; plan risk; create/update/delete counts; public-exposure flag; IAM/network/encryption change flags; cost band; destructive-replacement flag; drift; ticket/window.

• Environment resource.environment
• Reversibility effect.reversible
• Restore mode recovery.mode

What the payload fingerprint should bind

Provider/account/project; exact plan digest; resource addresses and before/after digests; create/update/delete/replace set; IAM, network, encryption, storage, and public-exposure deltas; region; estimated cost band; tool/version; state version/lock; rollback plan.

Policy recommendation — guidance only

Ask by default for production. Grant only low-risk non-production plans. Reject public exposure, broad IAM, unreviewed destructive replacements, or a plan digest that changed after approval.

Suggested decision context

Recovery vault and point; source/target tenant, region, environment and resource type; restore mode; overwrite flag; scope/size band; integrity and malware-scan results; encryption-key availability; downtime window; approval/ticket.

• Environment resource.environment
• Restore mode recovery.mode

What the payload fingerprint should bind

Exact recovery-point ID and creation time; source resource; target resource or replacement name; restore mode; selected point in time; resource-specific metadata; overwrite/current-state disposition; activation flags; encryption references; validation results; IAM role; idempotency token.

Policy recommendation — guidance only

Ask by default for production or in-place restore. Grant isolated test restores from verified points. Reject unknown or unscanned recovery points and cross-tenant restoration without explicit approval.

Suggested decision context

Secret/project prefix; exact version versus latest; environment; consumer workload; purpose; raw-return versus injection mode; destination; scope; TTL; human/model visibility; break-glass flag; network.

• Target privilege identity.target_privilege

What the payload fingerprint should bind

Secret resource and exact version; consumer identity; destination process/field; access mode; purpose; requested TTL; credential scope/audience; output channel; audit/ticket reference. Bind only a secret reference/version or keyed fingerprint, never the plaintext.

Policy recommendation — guidance only

Reject raw disclosure to an LLM or chat. Grant narrow workload injection. Ask for production, break-glass, export, or human-visible access.

Suggested decision context

Credential type/provider; subject and resource; environment; scheduled versus compromise trigger; consumer set; overlap window; predecessor disposition; delivery sink; verification status; privilege tier; ticket/window.

• Reversibility effect.reversible
• Target privilege identity.target_privilege

What the payload fingerprint should bind

Credential reference/version, never plaintext; subject/resource/scope; exact predecessor; generation policy; approved secret sink and consumer references; overlap duration; create/propagate/verify/disable/delete strategy; verification deadline; idempotency key.

Policy recommendation — guidance only

Optional core; ask for production, privileged, signing, or compromised credentials. Grant routine automated rotation into an approved secret store. Reject plaintext output and premature predecessor deletion.

Suggested decision context

Tenant/directory; account type; internal/external; sponsor/owner; verified domain; enabled state; baseline groups/roles; privilege tier; expiry; MFA/authentication policy; HR/ticket status; network/time.

• Target privilege identity.target_privilege

What the payload fingerprint should bind

Tenant; principal type; canonical login/identities; sponsor/owner; enabled state; profile fields; baseline role/group IDs; expiry; authentication policy and force-change flags; external issuer. Never bind raw passwords; bind a protected credential reference or fingerprint.

Policy recommendation — guidance only

Ask by default, especially for enabled, external, service, or privileged accounts. Grant only tightly controlled lifecycle provisioning from an authoritative source.

Suggested decision context

Tenant/account; principal type; current state; suspend versus disable; reason/incident/HR event; effective time and review/expiry; break-glass/final-admin status; session-revocation requirement; bulk band; approver separation.

• Operation mode operation.mode
• Reversibility effect.reversible
• Target privilege identity.target_privilege

What the payload fingerprint should bind

Provider/tenant and immutable account ID; expected current state/version; mode; reason/ticket/incident; effective time; review or expiry; preserve-data and ownership settings; session/token handling; actor and idempotency key.

Policy recommendation — guidance only

Grant for verified ordinary offboarding or compromise workflows. Ask for service, privileged, break-glass, bulk, or terminal actions. Reject disabling the final emergency administrator.

Suggested decision context

Resource/tenant; principal type and domain; role/scope; privilege tier; external flag; classification; expiry; conditional binding; delegation depth; separation of duties; current policy ETag; network/time.

• Target privilege identity.target_privilege

What the payload fingerprint should bind

Resource and policy ETag/version; principal stable ID/type; exact role and permissions; condition expression; scope; expiry; delegation chain; ownership-transfer and inheritance flags; justification/ticket; notification settings.

Policy recommendation — guidance only

Ask by default. Grant only expiring least-privilege internal roles from approved provisioning workflows. Reject public/anonymous grants and prohibited privilege escalation.

Suggested decision context

Resource/tenant; principal; exact permission; incident/offboarding reason; protected/break-glass identity; production service identity; cascade/inherited flag; final-owner/admin-quorum flag; policy ETag; ticket; network/time.

• Reversibility effect.reversible
• Target privilege identity.target_privilege

What the payload fingerprint should bind

Resource and policy ETag/version; principal; permission/role; direct versus inherited; cascade scope and fixed target set; reason/incident/ticket; remaining-owner/quorum snapshot; effective time.

Policy recommendation — guidance only

Grant for verified offboarding or compromise of ordinary users. Ask for production service identities, owners/admins, cascade, or recent grants. Reject final-owner removal and child-level revocation of inherited access.

Suggested decision context

Initiator and target principal; tenant/account/project; trust or permission basis; requested scope subset; resource/audience; TTL; MFA/step-up result; cross-account flag and external ID; session tags/claims; delegation depth; network.

• Target privilege identity.target_privilege

What the payload fingerprint should bind

Initiator and target stable IDs; authorization basis; target boundary; requested scopes/session policy; allowed tags/claims; duration/expiry; MFA evidence reference; external ID or nonce fingerprint; reason/ticket; session ID. Never hash or log the returned secret token itself.

Policy recommendation — guidance only

Optional core; ask for privileged, production, cross-account, or impersonated-human sessions. Grant short-lived narrowly scoped workload assumptions. Reject indefinite, privilege-amplifying, or untraceable sessions.

Suggested decision context

Delegate agent ID/version/owner; same-tenant flag; task type; permitted action intersection; maximum delegation depth; runtime/budget band; data classification; memory-sharing scope; external-tool/network profile; user-delegation status.

• Target privilege identity.target_privilege

What the payload fingerprint should bind

Parent and delegate identities/versions; task instructions digest; input resource IDs/versions and content digests; permitted-action set; resource prefixes; data classification; maximum depth/steps/runtime/budget; tool set; network and memory policy; result destination.

Policy recommendation — guidance only

Grant only to registered same-tenant delegates with no privilege expansion. Ask for external agents, sensitive data, new tools, or long-running/high-budget work. Reject cyclic, unbounded, or privilege-amplifying delegation.

Suggested decision context

Agent/environment; expected version; changed-field profile; tool additions/removals; model/provider; autonomy direction; limits/budget/concurrency; guardrail change; evaluation result; rollout strategy; change ticket.

• Target privilege identity.target_privilege

What the payload fingerprint should bind

Agent ID; expected and proposed versions; canonical before/after diff; system-prompt digest or secure reference; model and parameters; tools and versions; limits; memory/context policy; guardrails; autonomy/approval settings; evaluation attestation; activation and rollback plan.

Policy recommendation — guidance only

Optional core; ask for production or any capability/guardrail/autonomy change. Grant metadata-only or tested non-production changes. Reject self-expansion of authority and unversioned changes.

Suggested decision context

Policy type/owner/scope/environment; operation; base version; privilege or guardrail direction; impacted agent/principal/resource bands; wildcard/cross-tenant flag; simulation result; approver separation; effective time; emergency flag.

• Environment resource.environment
• Target privilege identity.target_privilege

What the payload fingerprint should bind

Policy ID/type/scope; base and proposed versions; exact canonical patch or document digest; semantic before/after diff; affected subjects, resources, actions and conditions; precedence/defaults; approval obligations; simulation/impact result; rollout, effective time, rollback version, reason/ticket.

Policy recommendation — guidance only

Optional core; ask by default. Reject unvalidated syntax, stale versions, wildcard privilege expansion, guardrail weakening, or unaudited emergency bypass.