Agent Action Manifest | Declare what AI agents may propose
Declare/Agent Action Manifest

Agent Action Manifest

Declare what actions an AI agent may propose before runtime execution.

A lightweight public schema and validator for describing an agent's tools, actions, authority requirements, review requirements, reliance requirements, payload policies, and redaction hints before runtime deployment.

Apache 2.0 JSON Schema Pydantic model Validator CLI Tests
Agent action manifest v1
toolcrm.records
action_typewrite
requires_authoritytrue
requires_reviewtrue
record_reliancetrue
redact_fields[ email ]
The problem

Most teams do not have an action inventory for their agents.

Before an agent enters production, the organization should know what tools it may use, what actions it may propose, which actions require authority, which require human review, what reliance evidence should be captured, and which payload fields may require redaction.

Without a manifest, this information is often scattered across code, prompts, tool definitions, policies, and tribal knowledge.

01

Tool access is unclear

Which tools an agent may call is often implied by code and prompts rather than declared in one place teams can review.

02

Privileged actions are not labeled

Writes, exports, purchases, deletes, and external sends are not consistently marked as the actions that need authority or review.

03

Human review requirements are inconsistent

Whether an action needs a person in the loop is decided ad hoc, so review coverage varies between teams and deployments.

04

Sensitive payload fields are not declared

Fields that carry personal or regulated data are rarely marked ahead of time, leaving redaction to guesswork at export.

05

Runtime controls lack a stable declaration source

Policy engines and control planes have no single, versioned inventory of the agent's action surface to enforce against.

06

The action surface drifts silently

As tools and prompts change, the real set of actions an agent can propose drifts away from any written description of it.

What it does

A manifest for the agent's action surface.

Agent Action Manifest helps teams create a structured declaration of what an agent may propose. It does not execute actions and does not enforce runtime controls by itself. It creates a portable action inventory that runtime systems can use or reference.

A — Tools

Tool definitions

Names each tool the agent may use, with a stable identifier runtime systems can reference.

B — Actions

Action declarations

Describes each action the agent may propose and the tool and action type it runs through.

C — Authority

Authority requirements

Marks which actions require an authorization context before they may proceed.

D — Review

Review requirements

Flags the actions that require human review before they can be executed.

E — Reliance

Reliance requirements

States which actions should record the sources the agent relied on.

F — Payloads

Payload policies

Constrains the shape and content of the payloads an action is allowed to carry.

G — Redaction

Redaction hints

Marks the fields that should be redacted when run records are exported.

H — Validation

Manifest validation

Checks a manifest against the schema so declarations stay well-formed and complete.

Example questions it answers

What can this agent do, before it runs?

What actions can this agent propose?
Which tool does each action use?
Is the action a read, write, export, approval, purchase, delete, or external send?
Does the action require authority?
Does the action require human review?
Should reliance be recorded?
Which fields are sensitive?
Which fields should be redacted in exports?
How it fits in the stack

The Declare layer of the Open Control Stack.

Agent Action Manifest is the Declare layer. It prepares a structured action inventory before runtime. Agent Control Plane can then record and govern the actions that the agent actually proposes during execution.

Declare Control Replay Evidence
What it is not

A declaration format — not enforcement.

×Not an agent framework
×Not a model runtime
×Not a policy engine
×Not a security boundary by itself
×Not a replacement for application authorization
×Not a complete governance platform
Open-source contents

What is in the repository.

JSON schema
Pydantic model
Manifest validator
CLI
Example manifests
Tests
Documentation
View on GitHub
Who it is for

Built for teams that need to declare an agent's action surface.

AI platform teams

Need a portable, versioned inventory of an agent's action surface that runtime systems can enforce against.

Security and risk leaders

Need to see which actions require authority or review before an agent reaches production.

Governance and compliance teams

Need a stable declaration of what an agent is permitted to propose, independent of prompts and code.

Developers building agent workflows

Need a small schema they can add beside existing tool definitions to declare intent before runtime.

Auditors and reviewers

Need a human-readable record of the agent's declared action surface at a fixed point in time.

Get started

Create a governed action inventory before your agent runs.

View on GitHub