Agent capability policies
Reusable configuration, optional long-term memory, consistent execution semantics.
中文Catalog ownership and Agent references
An Agent selects capability scope without copying definitions. Programs own callable Tools, Workflows and Applications; Skills own procedural instructions; MCP owns connections and credentials. These stay distinct in the editor. See the configuration contract for inheritance and enforced authority.
| Catalog | Agent stores | Agent never stores |
|---|---|---|
| Programs | Policy, preset reference, explicit names and denies | Python source, expanded schemas, workflow repositories |
| Skills | Mode, names/categories, exclusions | A copied Skill directory or permanently injected full text |
| MCP | Allowed and required service references | Credentials, authentication cookies, server implementations |
Policy algebra and migration
| Mode | Requested set | Constraint |
|---|---|---|
| inherit | Use base policy | Resolved before discovery |
| all | All globally available entries | Denies and enforced ceilings still apply |
| selected | Explicit names and category filters intersect; Programs may instead reference one preset | Explicit allowed=[] means empty; preset + explicit names is invalid for Programs |
| none | Empty | Cannot be bypassed by a deferred explicit-name load |
Effective set = requested set ∩ global availability ∩ caller authority ∩ parent delegation ceiling ∩ environment restrictions − explicit denies. Missing refs remain stored but not callable. Required MCP refs must be a subset of effective services; reject contradictory patterns, including wildcard denies. Skill instructions cannot authorize the tools they mention.
Canonical target policies gain an explicit mode for Skills/MCP as well as Programs. Legacy automatic maps to all; legacy disabled=["*"] maps to none; nonempty allowed/categories maps to selected; legacy empty allowlists map to all only during schema migration. Target selected=[] must never pass through legacy empty-is-all semantics. For Skills selected mode, omitted allowed with nonempty categories means category filtering alone; nonempty allowed and categories intersect. A declared category must match; items without a category retain the existing exemption and the UI shows them as uncategorized. Explicit allowed=[] means no entries, even when categories are present. Neither names nor categories selects anything when both are absent. Migrate a legacy empty allowed list by omitting it if categories are active, preserving the old predicate rather than turning it into an empty explicit whitelist. Normalize at one boundary, not independently in UI, search and executor.
Discovery, invocation and change propagation
- Profile save stores intent. A run resolves a versioned effective scope and catalog/preset references; no full schema inventory enters the first prompt.
- tool_search searches only the effective allowed scope and returns limited matching schemas. Explicit names and nested workflow/program entry calls use the same policy.
- Invoke rechecks revocation, availability and resource permission. Globally disabled entries stop being callable immediately at the next boundary even in queued or pinned runs.
- Optional MCP outage disables that service and surfaces status; required outage blocks admission/startup. Auth errors never trigger automatic connection to a different account.
- Selectors display missing names until explicitly removed. Save does not erase them. A preset update affects newly resolved calls; in-flight snapshots retain intended selections subject to revocation.
- Memory read/write tools are additionally narrowed by the execution memory policy. A capability allowlist cannot override memory off or read-only.
Editor responsibilities
Keep Programs, Skills and MCP separate. Each shows mode, inherited source, effective count, missing count and a catalog action. Catalogs load only when opened. Categories/presets are selectors, not copies. MCP adds required markers and global connection links. Credentials remain outside the draft. The Programs selector document owns list/tree/inspector behavior; do not repeat its catalog here.
Acceptance: selected empty is empty at search and call, denied explicit names fail, missing required service blocks before side effects, missing references survive reload, changing tabs preserves the one draft, and memory-off tools cannot execute. Current policy primitives exist; target canonical modes and cross-entry enforcement remain pending the implementation plan.