HITL, Policies, and Contracts

Journey B — Safety

Write tools need approval (F7–F8)

Meridian marks irreversible tools with requiresApproval: true (e.g. processRefund, freezeAccount) and runs with durableSuspend so the worker can pause without holding the HTTP request open forever.

Deep-dive: /guides/add-human-approval-without-breaking-the-run, /patterns/human-approval-gate.

Lab — refund with HITL off, then on

Default (auto-approve):

# AGENT_OS_HITL=0 (default)
curl -s localhost:3060/api/support/chat \
  -H 'content-type: application/json' \
  -d '{"message":"I want a refund for ORD-1002"}' | jq .

Real HITL:

1. Set AGENT_OS_HITL=1 in .env, restart npm run dev.
2. Send the refund curl again — expect a pending approval / suspended run.
3. Approve:

curl -s -X POST localhost:3060/api/approvals/<requestId>/approve | jq .

Policies and contracts (F8–F9)

PolicyEngine encodes require_approval / deny beyond prompt hope (src/agents/agents.module.ts). Support paths can fall back to safe-desk under contract/recovery options when the primary path fails — degrade safely.

Digital twin / canary (F10) exists for shadow compare before cutover — overview only here; use when promoting risky prompt/DNA changes.

Anti-confusion (repeat until boring)

npm run demo:smoke-cli   # F6 — see the contrast explicitly

Checkpoint D

You can explain why CLI smoke must never be used to “prove” a refund worked.