How an agent request flows through the console — validation, sandbox execution, SSE streaming, and the risk ladder that gates writes.
Agent interactions route through /api/ai/agent-chat and stream back over Server-Sent Events.
The pipeline’s job is to get a request into a sandbox safely and stream what happens.
Steps 1–3 are all authorisation, in widening scope: is this a real session, does it own this chat,
and what may it reach. A failure at step 2 is the interesting one — it means a legitimate user
reached someone else’s conversation.
Handle error and stream_end as separate cases. An error may be followed by stream_end, so
treating either as “the stream is over” without distinguishing them loses the reason it ended.
const res = await fetch(`/api/agent/sessions/${id}/stream`, { headers: { Accept: "text/event-stream" },});let ended = false;for await (const evt of parseSSE(res.body)) { switch (evt.type) { case "message": render(evt.data.text); break; case "tool_call": showPending(evt.data.tool); break; case "error": // keep the reason; stream_end will follow and carries none recordFailure(evt.data); break; case "done": case "stream_end": ended = true; break; }}if (!ended) recordFailure({ reason: "stream closed without a terminal event" });
Tool calls are classified, and the classification decides whether a human confirms. This is the
mechanism, not a policy setting:
Classification
Level
Confirmation
read
0
—
write
1
—
unknown
2
—
financial
3
Required
destructive
4
Required
bulk
5
Required
Confirmation is required at level 3 and above.
An unrecognised tool classifies as unknown at level 2 — below the confirmation threshold. So a
tool the classifier doesn’t know about executes without a human, and the safe-looking default is not
actually fail-closed for novel tools.If you add a tool that moves money or deletes data, make sure it classifies as financial,
destructive, or bulk rather than relying on the default.
A sensitive tool call emits a confirmation event rather than executing. The client returns a
confirmation_token, and only then does the action run. Tokens are single-use, so a captured token
can’t be replayed to authorise a second action.
Tool calls are validated against policy before execution, backed by
NSR guardrails. The console’s risk ladder is the coarse gate; NSR is
where per-action authorisation with a cited proof happens.
