Skip to main content
Action, retrieval, and delegation are not three engines — they are one engine evaluating one event against the operations it carries. The unified surface is the operation-native way to manage that engine: a single rules collection whose every row declares which operations it applies to, and a single POST /evaluate call that spans every facet with one decision vocabulary.
The per-facet surfaces still exist and are not deprecated. The action (/allow/*) and retrieval (/recall/*) rule-management and evaluation endpoints are permanent, additive compatibility aliases over the same rules table. Use whichever surface fits — a rule created here is visible there, and vice versa.

​
One rule, many operations

Every rule carries an operations[] array — its applies_to set, drawn from action, retrieval, and delegation. A rule can target one operation or several:
  • A rule with operations: ["action"] governs tool calls.
  • A rule with operations: ["retrieval"] governs retrieved context.
  • A rule with operations: ["delegation"] governs agent-to-agent handoffs.
  • A rule with operations: ["retrieval", "action"] governs a hybrid read-then-write tool with one decision.
Because all facets share one table, listing, creating, updating, and deleting rules is one set of endpoints — GET/POST /rules, GET/PUT/DELETE /rules/:id — with an optional ?operations= filter to scope a listing to a facet.

​
One decision vocabulary

The unified POST /evaluate call returns outcomes from the full union set: A single-facet event resolves to one outcome. A hybrid event (for example operations: ["retrieval", "action"]) is evaluated on both facets and combined most-restrictively — a deny on either facet denies the whole event (fail-closed).

​
One bundle for the SDK

The tagged SDK runtime pulls one bundle from GET /rules/bundle covering both the action and retrieval facets, and evaluates every event locally against it — the same policy interpreter the server runs, so local and remote decisions agree by construction. The bundle carries the agent’s server-authoritative mode and attributes, a content-addressed version ETag, and a min_dialect floor: an SDK too old to honour the bundle’s constructs refuses it and fails closed rather than mis-applying a restriction it cannot understand.

​
Next steps

API Reference

Unified rule CRUD, the SDK bundle, and the POST /evaluate call.

Action Governance

The action facet and its compatibility endpoints.

Retrieval Governance

The retrieval facet and its compatibility endpoints.

Delegation Governance

The delegation facet and the grant lifecycle.