Repository navigation
feat: ask before destructive or financial calls to env systems - #112
Merged
Merged
Conversation
Systems whose token is delivered to the runtime cannot be intercepted by the platform, so the business system section of the prompt now tells the agent to describe any irreversible (destructive) or money-moving (financial) operation, its target and its effect to the current speaker and run it only after an explicit confirmation in a later message. Where nobody can confirm, as in scheduled runs, it explains what should be done instead. Turns with only proxied systems are unchanged, since the proxy already refuses these operations. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…ite-destructive-8a2c5d
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
env) cannot be intercepted by the platform: the agent holds the token and can call any operation the speaker is allowed to. Until now the prompt only showed[destructive]/[financial]labels in the catalog without saying what to do with them.envsystem, the business system section now addsENV_RISK_RULES: before an irreversible (destructive: delete, void, post, reverse) or money-moving (financial: refund, payout) operation, describe the operation, target and effect to the current speaker and run it only after an explicit confirmation in a later message; where nobody can confirm (scheduled runs), explain what should be done instead.No API, migration or runtime node changes. Codex conversations resumed from an earlier turn keep their first system prompt, so the rule reaches them after a reset.
Test plan
pytest tests/api/test_systems_catalog.py tests/api/test_systems_proxy.py tests/integration/test_system_access.py tests/unit/test_system_prompt.py(41 passed): env turn includes the rule, proxy-only turn does notruff check,ruff format --check,mypyon the changed module🤖 Generated with Claude Code