ĀML™ / AGENT BUILD
FROM A PROPOSAL TO A HOST-OWNED TOOL

The agent can ask.
Your host decides.

Give one function tool an exact policy boundary. Start with a local callback that sends nothing; then replace only the host-owned pieces with your actual policy, approval, and service.

Build the boundary ↓
ĀML / FUNCTION TOOL PATHNO LIVE DELIVERY
01

Run the local rehearsal.

This runs the checked-in experimental adapter, then rechecks controlled host paths against the report below. Every callback is a fixture; no message is sent. Record your checkout commit when sharing a result.

git clone --depth 1 https://github.com/aruintelligence/aml-core.git cd aml-core git rev-parse HEAD node pilots/action-boundary/guarded-tool-demo.mjs node pilots/action-boundary/guarded-tool-rehearsal.mjs --check

HOST REHEARSAL / CONTROLLED CASES

Where does the call stop?

Choose a condition. Use arrow keys, Home, or End after focusing a case. These are recorded results from the project adapter running local fixtures, with approval and callback counts visible.

  • DISPATCHEDfixture returned
  • BLOCKEDno tool callback
  • UNKNOWNoutcome uncertain
  • HOST ERRORno plan or receipt
Jump to selected result ↓Inspect the complete report ↗
OBSERVED IN THE LOCAL REHEARSAL

Loading the report…

Checking the project-authored snapshot.

HOST DESIGN MOVE

REPRODUCE OR SHARE THIS CASE
node pilots/action-boundary/guarded-tool-rehearsal.mjs --case changed_destination

The hook trace records which fixture hooks ran; it does not expose every internal policy check. A host mapper error occurs before a plan or receipt exists, but the mapper may already have changed host state. A dispatched receipt means the fixture callback returned. An unknown receipt does not mean no side effect occurred. A claim-hook error can leave a grant spent without entering the tool callback. An approval-hook error can leave host authorization state changed. In-memory fixture writes are local markers, not provider delivery. Neither proves real approval, service delivery, or production safety.

02

Move the boundary into your host.

The real host owns the tool identity, effect, resource mapping, policy, authenticated approval, one-use claim, and service call. This sketch deliberately throws until you implement the three host functions. It imports the project preview from your checkout.

import { createGuardedToolExecute } from "./pilots/action-boundary/guarded-tool.mjs"; const policy = { protocol: "aml-action-policy/1", rules: [{ tool: "send_message", effect: "send", resource: "team@example.test", requires_approval: true }] }; async function hostApproveExact(proposal, proposal_sha256, context) { throw new Error("Authenticate approval and issue a one-use grant for this exact proposal"); } async function hostConsumeGrantOnce(input, context) { throw new Error("Atomically consume the host-issued grant in durable storage"); } async function sendFromHost(args, context) { throw new Error("Implement the provider call using these exact arguments"); } export const execute = createGuardedToolExecute({ tool: "send_message", effect: "send", purpose: "Send a team update", resourceFor: args => args.to, policy, requestApproval: ({ proposal, proposal_sha256 }, context) => hostApproveExact(proposal, proposal_sha256, context), consumeApproval: (input, context) => hostConsumeGrantOnce(input, context), execute: (args, context) => sendFromHost(args, context) });

The approval hook must return { approved: true, proposal_sha256 } for the exact frozen proposal and identify a host-issued grant. The claim hook must atomically consume that grant once and return exactly true. For callbacks with CC/BCC or transformed provider requests, use the dedicated adapters in the full guide. Do not copy the rehearsal’s automatic approval into a real host.

Before a receipt exists. The host resourceFor mapper runs on a canonical argument snapshot. If it throws, returns a non-string, or mutates that snapshot, the adapter rejects before planning or entering the tool callback. Handle the host error separately; no dispatch receipt is produced.
03

Recheck before any real dispatch.

The host must supply its own authentication, durable one-use claims, operation idempotency, audit storage, and honest mapping to the provider request. An unknown callback result might already have caused a side effect; this wrapper does not retry it.

A digest binds the proposal bytes. It does not prove who approved them, whether the policy is trustworthy, or whether the outside service completed the action.
Full function-tool guide ↗Inspect the adapter ↗Multi-recipient mail path ↗