# Profiles and action classes

> The action classes, the safe-default rules, the agent profiles and the action_class rule condition.

Source: https://docs.atensecurity.com/docs/getting-started/profiles

## Action classes

A declaration says what a tool does. Decisions use only declarations confirmed
on the server, never a request body, a model or a proposal.

| Class | Meaning |
| --- | --- |
| `read` | Reads data |
| `write` | Writes or changes data |
| `delete` | Deletes data |
| `execute` | Runs code or commands |
| `export` | Exports data |
| `external_call` | Calls a system outside yours |
| `bulk_operation` | Acts on many records at once |
| `credential_access` | Accesses keys, tokens or secrets |
| `sensitive_data_access` | Accesses sensitive data |
| `unknown` | No confirmed declaration |

A tool with several classes gets the most restrictive outcome among them.

## `safe-default` (version 1.0.0)

| Rule | When | Decision |
| --- | --- | --- |
| Protect sensitive data from leaving | `sensitive_data_access` with `export` or `external_call` | `BLOCK` |
| Allow reading data | `read` | `ALLOW` |
| Allow sensitive data inside your system | `sensitive_data_access` | `ALLOW` |
| Allow writing data | `write` | `ALLOW` |
| Review running code | `execute` | `STEP_UP` |
| Review deleting data | `delete` | `STEP_UP` |
| Review bulk changes | `bulk_operation` | `STEP_UP` |
| Review exporting data | `export` | `STEP_UP` |
| Review internet calls | `external_call` | `STEP_UP` |
| Review accessing credentials | `credential_access` | `STEP_UP` |
| Confirm this tool first | `unknown` | `STEP_UP` |

Blocklists, quarantine, quotas and other hard constraints still apply first.

## Agent profiles

Each profile is `safe-default` plus named rules. Named rules apply to
**confirmed** tools with the exact tool names below; an unconfirmed tool steps
up before any named rule runs.

### `coding-agent`

| Rule | Tools | Decision |
| --- | --- | --- |
| Code stays on approved remotes | `git_push`, `git.push` with a `remote` URL whose host is not in `approved_remote_hosts` | `BLOCK` |
| Named remotes need an approver | `git_push`, `git.push` with a remote name, such as `origin`, rather than a URL | `STEP_UP` |
| Production releases need an approver | `deploy_release`, `deploy.release` with `environment` `production` or `prod` (the default) | `STEP_UP` |
| Secrets files stay private | `read_file`, `read.file` with a `path` named `.env`, `.env.*`, `credentials`, `secrets.json`, `secrets.yaml`, `id_rsa` or `id_ed25519` | `BLOCK` |

### `finance-operations`

| Rule | Tools | Decision |
| --- | --- | --- |
| Vendor bank details never change through the agent | `update_vendor_bank_details`, `vendor.update_bank_details` | `BLOCK` |
| Large payments need the controller | `pay_invoice`, `initiate_transaction`, `payment.transfer` with `amount_usd` at or above `payment_approval_amount_usd` | `STEP_UP` |
| New payees need an approver | `create_payee`, `payee.create` | `STEP_UP` |

### `customer-support`

| Rule | Tools | Decision |
| --- | --- | --- |
| Large refunds need an approver | `issue_refund`, `refund.issue` with `amount_usd` at or above `refund_approval_amount_usd` | `STEP_UP` |
| Customer personal data stays inside | `sensitive_data_access` with `export` or `external_call` | `BLOCK` |
| Account deletion needs an approver | `delete_account`, `account.delete` | `STEP_UP` |

A missing, non-numeric or non-finite `amount_usd` always needs an approver.

### Parameters

| Parameter | Default | Profile |
| --- | --- | --- |
| `payment_approval_amount_usd` | 10000 | `finance-operations` |
| `refund_approval_amount_usd` | 5000 | `customer-support` |
| `approved_remote_hosts` | none: every push needs a match | `coding-agent` |

Parameters are available on paid plans, through `profile_parameters_json` in
`thoth_pack_assignment`. Amounts must be positive. Hosts are exact host names,
without wildcards or paths.

## Selection and versions

- **Trial:** one profile for the workspace, chosen at signup or once later.
  Parameters are not available.
- **Paid:** a profile per agent, with parameters.
- **Versions** are pinned per agent. Moving to another version or profile
  needs an admin with recent MFA, or a Terraform change to `profile_version`.
- **Removing** a profile returns the agent to `safe-default`.

## The `action_class` condition

Custom rules can match the server classification:

```text
action_class == delete
action_class in [delete, external_call]
```

`unknown` is a matchable value. The condition reads confirmed declarations only.