Profiles and action classes
The action classes, the safe-default rules, the agent profiles and the action_class rule condition.
Action classes
A declaration says what a tool does. Decisions use only declarations confirmed on the server, never a request body, a model or a proposal.
| Class | Meaning |
|---|---|
read | Reads data |
write | Writes or changes data |
delete | Deletes data |
execute | Runs code or commands |
export | Exports data |
external_call | Calls a system outside yours |
bulk_operation | Acts on many records at once |
credential_access | Accesses keys, tokens or secrets |
sensitive_data_access | Accesses sensitive data |
unknown | No confirmed declaration |
A tool with several classes gets the most restrictive outcome among them.
safe-default (version 1.0.0)
| Rule | When | Decision |
|---|---|---|
| Protect sensitive data from leaving | sensitive_data_access with export or external_call | BLOCK |
| Allow reading data | read | ALLOW |
| Allow sensitive data inside your system | sensitive_data_access | ALLOW |
| Allow writing data | write | ALLOW |
| Review running code | execute | STEP_UP |
| Review deleting data | delete | STEP_UP |
| Review bulk changes | bulk_operation | STEP_UP |
| Review exporting data | export | STEP_UP |
| Review internet calls | external_call | STEP_UP |
| Review accessing credentials | credential_access | STEP_UP |
| Confirm this tool first | unknown | STEP_UP |
Blocklists, quarantine, quotas and other hard constraints still apply first.
Agent profiles
Each profile is safe-default plus named rules. Named rules apply to
confirmed tools with the exact tool names below; an unconfirmed tool steps
up before any named rule runs.
coding-agent
| Rule | Tools | Decision |
|---|---|---|
| Code stays on approved remotes | git_push, git.push with a remote URL whose host is not in approved_remote_hosts | BLOCK |
| Named remotes need an approver | git_push, git.push with a remote name, such as origin, rather than a URL | STEP_UP |
| Production releases need an approver | deploy_release, deploy.release with environment production or prod (the default) | STEP_UP |
| Secrets files stay private | read_file, read.file with a path named .env, .env.*, credentials, secrets.json, secrets.yaml, id_rsa or id_ed25519 | BLOCK |
finance-operations
| Rule | Tools | Decision |
|---|---|---|
| Vendor bank details never change through the agent | update_vendor_bank_details, vendor.update_bank_details | BLOCK |
| Large payments need the controller | pay_invoice, initiate_transaction, payment.transfer with amount_usd at or above payment_approval_amount_usd | STEP_UP |
| New payees need an approver | create_payee, payee.create | STEP_UP |
customer-support
| Rule | Tools | Decision |
|---|---|---|
| Large refunds need an approver | issue_refund, refund.issue with amount_usd at or above refund_approval_amount_usd | STEP_UP |
| Customer personal data stays inside | sensitive_data_access with export or external_call | BLOCK |
| Account deletion needs an approver | delete_account, account.delete | STEP_UP |
A missing, non-numeric or non-finite amount_usd always needs an approver.
Parameters
| Parameter | Default | Profile |
|---|---|---|
payment_approval_amount_usd | 10000 | finance-operations |
refund_approval_amount_usd | 5000 | customer-support |
approved_remote_hosts | none: every push needs a match | coding-agent |
Parameters are available on paid plans, through profile_parameters_json in
thoth_pack_assignment. Amounts must be positive. Hosts are exact host names,
without wildcards or paths.
Selection and versions
- Trial: one profile for the workspace, chosen at signup or once later. Parameters are not available.
- Paid: a profile per agent, with parameters.
- Versions are pinned per agent. Moving to another version or profile
needs an admin with recent MFA, or a Terraform change to
profile_version. - Removing a profile returns the agent to
safe-default.
The action_class condition
Custom rules can match the server classification:
unknown is a matchable value. The condition reads confirmed declarations only.