Capability policy outside the model — deny unknown actions before confirmation.

Action policy

Compose trusted capability policy into the same ChatConfig used by every renderer. Policy runs outside the model — prompts cannot grant capabilities.

Flow

Loading diagram...

Compose policy

code

import { createCapabilityPolicy, withActionPolicy } from '@agentskit/chat'

const policy = createCapabilityPolicy({
  sessionId,
  getContext: () => authenticatedSession, // trusted host seam only
  requirements: {
    'email.send': ['email:send'],
    'docs.open': [],
  },
  onTrace: trace => auditBuffer.push(trace),
})

const chat = withActionPolicy(baseChat, policy)

Rules

Rule	Detail
Trusted context	`getContext` is a host seam — never from prompts, messages, or component props
Deny by default	Unknown actions and missing context fail before confirmation
Double-check	Capabilities re-checked immediately before execution (revocation works after UI shown)
Traces	Immutable and replayable — not a durable audit ledger; persist in the host if required

Wire with confirmation

code

<AgentChat
  definition={definition}
  onComponentSelect={(event) => {
    // choice may carry action → policy + confirmation path
  }}
/>

See Typed confirmation and Components.

Action policy

Action policy

Flow

Compose policy

Rules

Wire with confirmation

Related

On this page