Agent Action Guard

Evaluate AI agent tool calls before execution. Match actions against policy rules to return an allow, review, or block decision. Supports custom policies via policy_id(Developer plan and above).

Endpoint

POST /api/v1/security/agent-action

Request body

{
  "tool_name": "Name of the tool or service (required, 1–200 characters)",
  "action": "Action being performed (required, 1–200 characters)",
  "arguments": { "key": "value" },
  "context": "Optional free-text context (max 2,000 characters)",
  "policy_id": "Optional UUID of a custom policy from your dashboard"
}

Example request

curl -X POST "https://www.identicapi.com/api/v1/security/agent-action" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "tool_name": "database",
  "action": "delete_users",
  "arguments": {
    "table": "users",
    "filter": "all"
  },
  "context": "User requested bulk deletion"
}'

const response = await fetch("https://www.identicapi.com/api/v1/security/agent-action", {
  method: "POST",
  headers: {
    "Authorization": "Bearer process.env.IDENTICAPI_KEY",
    "Content-Type": "application/json"
  },
  body: JSON.stringify({
    "tool_name": "database",
    "action": "delete_users",
    "arguments": {
      "table": "users",
      "filter": "all"
    },
    "context": "User requested bulk deletion"
  })
});

const data = await response.json();
console.log(data);

Response

{
  "request_id": "req_abc123",
  "api": "agent-action-guard",
  "decision": "block",
  "risk": "high",
  "matched_rule": "Block destructive actions",
  "policy_reason": "Rule \"Block destructive actions\" (destructive_action)",
  "findings": [
    {
      "category": "destructive_action",
      "reason": "Matched policy rule: Block destructive actions",
      "confidence": 0.9
    }
  ],
  "reasons": ["Policy rule \"Block destructive actions\" matched — decision: block"],
  "usage_units": 1,
  "processing_time_ms": 4
}

Decision semantics

Decision	Risk	Meaning
`allow`	low	Action is permitted by policy.
`review`	medium	Action requires human review before proceeding.
`block`	high	Action is denied by policy.

Default policy rules

When no custom policy_id is provided, the built-in default policy applies:

Priority	Rule	Condition	Decision
100	Block destructive actions	`destructive_action` — delete, drop, truncate, destroy, etc.	block
90	Allow read-only operations	`action_type: read_only` — get, list, read, fetch, search, etc.	allow
80	Block actions with secrets	`contains_secret` — secrets detected in tool context	block

Default decision when no rules match: review.

Rule condition types

tool_name — tool name contains the condition value
action_type — matches read-only actions or custom action substrings
destructive_action — action or context contains destructive keywords
contains_secret — PII/secrets detected in the combined context
domain_pattern — URLs in context match the condition value
data_scope — context contains the condition value

Usage

Each request consumes 1 usage unit.

Limitations

Rules are evaluated by priority (highest first); the first matching rule wins.
Custom policies require a valid policy_id owned by your account.
Secret detection reuses the PII & Secrets detector on the combined tool context string.
Policy decisions are advisory — enforce them in your agent runtime before executing tools.