ACAgentic Craft

Intermediate~15 minHazelJS

Bounded Autonomy

Cap what a HazelJS agent may do unsupervised using capabilities, PolicyEngine effects, maxSteps, and HITL—not prompt instructions alone.

Authors
editorial-team
Published
Last reviewed

Problem

Teams argue all-or-nothing autonomy; demos ship with unrestricted ToolRegistry and no enforceable ceiling.

Context

Any production AgentRuntime where write tools, MCP skills, or Skillgate surfaces exist. Product needs progressive autonomy levels with explicit ceilings.

Forces and constraints

  • Autonomy improves speed-to-resolution
  • Blast radius must be reviewable by security
  • Prompt-only limits are ignored under pressure
  • Different agents need different capability sets

Recommended design

Declare autonomy as layered controls: (1) ToolRegistry / Skillgate curated surface, (2) @Agent capabilities (e.g. orders.read) enforced by PolicyService, (3) PolicyEngine effects allow|deny|mask|require_approval, (4) maxSteps on execute/@Agent, (5) RunBudget maxTokens/maxCostUsd, (6) durableSuspend HITL for irreversible classes. Raise autonomy only after describeAgent gates pass.

Minimal pseudocode

@Agent({
  name: 'desk',
  capabilities: ['orders.read'], // empty = unrestricted — avoid in prod
  maxSteps: 8,
  version: '1.0.0',
})
class DeskAgent { /* @Tool methods */ }

const runtime = new AgentRuntime({
  policyEngine: new PolicyEngine([
    { id: 'no-shell', tool: 'shell', effect: 'deny', priority: 100 },
    { id: 'refund-hitl', tool: 'processRefund', effect: 'require_approval', priority: 20 },
  ]),
});

await runtime.execute('desk', goal, {
  maxSteps: 8,
  budget: { maxTokens: 50_000, maxCostUsd: 0.5 },
});

Failure modes

  • Empty capabilities treated as ‘open’ in production
  • Deny rules missing after MCP import expands tools
  • HITL fatigue → rubber-stamp approvals
  • Autonomy raised without eval regression suite

Security considerations

  • Least privilege capabilities per agent identity
  • Review Skillgate/MCP report() on every surface expand
  • Authenticate approvers; dual control for critical classes

Observability signals

  • Count policy deny / require_approval events
  • Dashboard: unsupervised write rate
  • Alert when new tools appear without policy coverage

Evaluation approach

describeAgent cases for deny and HITL paths; capability-negative tests (agent without payments.write cannot refund).

Trade-offs

  • Tighter bounds slow some resolutions vs unbounded demos
  • More policy rules increase maintenance—group by tool class

Sources

Related patterns