Servers Playground How we check Add a server Log in

Mnemom — Trust Ratings for AI Agents

Working · 2.5 s

io.github.mnemom/mnemomv1.0.2

Trust infrastructure for AI agents: read a verifiable Trust Rating, claim an identity, earn a badge.

AI & Agents Security

Source Website Registry entry

Maintain this server? Claim it

Try it

Call this server's tools from your browser. Nothing to install.

https://api.mnemom.ai/mcp?profile=directory

Requests go through mcptry because browsers can't call most MCP servers directly. Header values are sent to the server for that request only and are never stored or logged.

Tool list from our last check. Connect live to refresh it.

claim_agent Destructive

Claim a verifiable identity — bind an agent to your organization so its trust and accountability record is provably yours. Requires the agent's possession proof (`hash_proof`). Re-claiming an agent you already own keeps its original claim date but files it under the organization you pass (`org_id`; if omitted, your personal organization), which can change the organization that owns and bills it.

agent_idstring, required

Agent identifier (e.g. smolt-abc123)

hash_proofstring, required

Agent possession proof — either the live birth token (`mnbt_…`) whose row pins this agent's hash, or the full 64-hex SHA-256 digest of `${apiKey}|${agentName}` (or `${apiKey}` for an unnamed singleton agent).

org_idstring

Optional. The organization to claim the agent into (e.g. `org-...` or `pers-...`). The caller must be a member of this org (role floor: member). If omitted, the agent is claimed into the caller's personal org.

The server marks this tool as destructive. Running it may delete or overwrite data on the server or in any account you connected with your headers.

I understand, run it anyway

Mnemom — Trust Ratings for AI Agents MCP server | mcptry

Mnemom — Trust Ratings for AI Agents

Working · 2.5 s

io.github.mnemom/mnemomv1.0.2

Trust infrastructure for AI agents: read a verifiable Trust Rating, claim an identity, earn a badge.

AI & Agents Security

Source Website Registry entry

Maintain this server? Claim it

Try it

Call this server's tools from your browser. Nothing to install.

https://api.mnemom.ai/mcp?profile=directory

Requests go through mcptry because browsers can't call most MCP servers directly. Header values are sent to the server for that request only and are never stored or logged.

Tool list from our last check. Connect live to refresh it.

claim_agent Destructive

agent_idstring, required

Agent identifier (e.g. smolt-abc123)

hash_proofstring, required

org_idstring

The server marks this tool as destructive. Running it may delete or overwrite data on the server or in any account you connected with your headers.

I understand, run it anyway

Tools (15)

claim_agent

destructive

Argument	Type	Description
org_id	string	Optional. The organization to claim the agent into (e.g. `org-...` or `pers-...`). The caller must be a member of this org (role floor: member). If omitted, the agent is claimed into the caller's personal org.
agent_id*	string	Agent identifier (e.g. smolt-abc123)
hash_proof*	string	Agent possession proof — either the live birth token (`mnbt_…`) whose row pins this agent's hash, or the full 64-hex SHA-256 digest of `${apiKey}\|${agentName}` (or `${apiKey}` for an unnamed singleton agent).

Input schema (JSON)

{
  "type": "object",
  "required": [
    "agent_id",
    "hash_proof"
  ],
  "properties": {
    "org_id": {
      "type": "string",
      "description": "Optional. The organization to claim the agent into (e.g. `org-...` or `pers-...`). The caller must be a member of this org (role floor: member). If omitted, the agent is claimed into the caller's personal org."
    },
    "agent_id": {
      "type": "string",
      "description": "Agent identifier (e.g. smolt-abc123)"
    },
    "hash_proof": {
      "type": "string",
      "minLength": 16,
      "description": "Agent possession proof — either the live birth token (`mnbt_…`) whose row pins this agent's hash, or the full 64-hex SHA-256 digest of `${apiKey}|${agentName}` (or `${apiKey}` for an unnamed singleton agent)."
    }
  },
  "additionalProperties": false
}

get_agent

Look up an agent's public identity and trust state by ID — the accountable record other agents and humans can rely on.

read-only

Argument	Type	Description
agent_id*	string	Agent identifier (e.g. smolt-abc123)

Input schema (JSON)

{
  "type": "object",
  "required": [
    "agent_id"
  ],
  "properties": {
    "agent_id": {
      "type": "string",
      "description": "Agent identifier (e.g. smolt-abc123)"
    }
  },
  "additionalProperties": false
}

get_reputation

Look up an AI agent's published Trust Rating — Mnemom's portable reliability signal for autonomous software, computed from the agent's own verified activity record. Returns the rating plus the technical factors behind it. Free, public, read-only: ratings are public by default, unless the agent's owner has opted out.

read-only

Argument	Type	Description
agent_id*	string	Agent identifier (e.g. smolt-abc123)

Input schema (JSON)

{
  "type": "object",
  "required": [
    "agent_id"
  ],
  "properties": {
    "agent_id": {
      "type": "string",
      "description": "Agent identifier (e.g. smolt-abc123)"
    }
  },
  "additionalProperties": false
}

get_reputation_badge

Get an embeddable Trust Rating badge for an agent — returns the badge image URL plus ready-to-paste Markdown and HTML snippets for a README or agent card.

read-only

Argument	Type	Description
agent_id*	string	Agent identifier (e.g. smolt-abc123)

Input schema (JSON)

{
  "type": "object",
  "required": [
    "agent_id"
  ],
  "properties": {
    "agent_id": {
      "type": "string",
      "description": "Agent identifier (e.g. smolt-abc123)"
    }
  },
  "additionalProperties": false
}

get_started

Zero-auth, no-args orientation: who Mnemom is, the surface map, how to authenticate and what it unlocks, and the tools to try right now (scan_trust and the reputation lookups).

read-only

Argument	Type	Description
token	string	Optional Dojo try-me invite token. When supplied and valid, returns the token-gated dojo briefing manifest (the same content as GET /v1/dojo/try-me/resolve); omit for public orientation.

Input schema (JSON)

{
  "type": "object",
  "properties": {
    "token": {
      "type": "string",
      "description": "Optional Dojo try-me invite token. When supplied and valid, returns the token-gated dojo briefing manifest (the same content as GET /v1/dojo/try-me/resolve); omit for public orientation."
    }
  },
  "additionalProperties": false
}

list_agents

List the agents your account owns, with pagination (`limit`, `offset`). Read-only.

read-only

Argument	Type	Description
limit	integer	How many agents to return, 1-100.
offset	integer	How many agents to skip, for pagination.

Input schema (JSON)

{
  "type": "object",
  "properties": {
    "limit": {
      "type": "integer",
      "default": 50,
      "maximum": 100,
      "minimum": 1,
      "description": "How many agents to return, 1-100."
    },
    "offset": {
      "type": "integer",
      "default": 0,
      "maximum": 100000,
      "minimum": 0,
      "description": "How many agents to skip, for pagination."
    }
  },
  "additionalProperties": false
}

preview_compose_alignment_by_agent

Dry-run an alignment card: shows the card that would result after merging with the platform, organization and team policies above it, plus any conflicts. Nothing is saved.

read-only

Argument	Type	Description
audit*	object	How long this agent's own decision log is kept, and whether it can be queried. Required. (This is the agent's audit policy — it is NOT Mnemom's retention policy for the card itself; see the tool's data-handling disclosure for that.)
values*	object	The values this agent declares it is bound by. Required.
agent_id*	string	The agent this card belongs to (e.g. `smolt-abc123`). Identifier only — never place an API key, a secret, an email address, or any other personal data in this field.
autonomy*	object	What the agent may do on its own authority. Required.
principal*	object	Whose authority this agent acts under. Required.
card_version*	string	Card schema version. REQUIRED by the server-side validator. Current canonical value: `unified/2026-04-26`.

preview_compose_protection_by_agent

Dry-run a protection card: shows the card that would result after merging with the platform, organization and team policies above it, plus any conflicts. Nothing is saved, and no publish grant is needed.

read-only

Argument	Type	Description
mode*	string	Screening mode for the protection pipeline. Required. `off` disables screening; `observe` records only; `nudge` warns; `enforce` blocks.
agent_id*	string	The agent this card belongs to (e.g. `smolt-abc123`). Identifier only — never place an API key, a secret, an email address, or any other personal data in this field.
thresholds*	object	Risk-score cutoffs, each in [0, 1] and ordered warn ≤ quarantine ≤ block. Required. Send the full set: a publish replaces the agent's current card rather than patching it.
card_version*	string	Card schema version. REQUIRED by the server-side validator. Current canonical value: `protection/2026-04-26`.
screen_surfaces*	object	Which traffic surfaces are screened. Required, with all four flags set.
trusted_sources*	object

put_alignment_by_agent

Publish or replace an agent's alignment card: its governance modes, the principal it acts for, its declared values, the actions it may take on its own, and its audit policy. The server merges the card with the platform, organization and team policies above it and stores the result. Use preview_compose_alignment_by_agent to dry-run first.

destructive

Argument	Type	Description
audit*	object	How long this agent's own decision log is kept, and whether it can be queried. Required. (This is the agent's audit policy — it is NOT Mnemom's retention policy for the card itself; see the tool's data-handling disclosure for that.)
values*	object	The values this agent declares it is bound by. Required.
agent_id*	string	The agent this card belongs to (e.g. `smolt-abc123`). Identifier only — never place an API key, a secret, an email address, or any other personal data in this field.
autonomy*	object	What the agent may do on its own authority. Required.
principal*	object	Whose authority this agent acts under. Required.
card_version*	string

put_protection_by_agent

Publish or replace an agent's protection card (screening mode, thresholds, trusted sources, protected assets). When connected by OAuth sign-in (e.g. ChatGPT), each publish first needs a one-time grant from the same signed-in account: open https://www.mnemom.ai/authorize-protection?agent_id=<agent_id>, approve, then publish within 15 minutes (each grant covers one publish). Required: agent_id, card_version, mode, thresholds, screen_surfaces and trusted_sources (protected_surface is optional); mode `enforce` also needs Safe House on the organization. Use preview_compose_protection_by_agent to dry-run without a grant.

destructive

Argument	Type	Description
mode*	string	Screening mode for the protection pipeline. Required. `off` disables screening; `observe` records only; `nudge` warns; `enforce` blocks.
agent_id*	string	The agent this card belongs to (e.g. `smolt-abc123`). Identifier only — never place an API key, a secret, an email address, or any other personal data in this field.
thresholds*	object	Risk-score cutoffs, each in [0, 1] and ordered warn ≤ quarantine ≤ block. Required. Send the full set: a publish replaces the agent's current card rather than patching it.
card_version*	string	Card schema version. REQUIRED by the server-side validator. Current canonical value: `protection/2026-04-26`.
screen_surfaces

report_recipe_fn_fp

Submit a false-positive / false-negative correction for one of Mnemom's automated detection rules (a 'recipe') — technical feedback that improves detection accuracy, like filing a bug report against a spam filter.

Argument	Type	Description
type*	string	`fn` = false negative (the recipe should have fired). `fp` = false positive (it fired on legitimate behaviour).
summary*	string	A short description of what the recipe got wrong — what it flagged, or what it missed, and why that was incorrect. DESCRIBE the misfire; do NOT paste the conversation, the prompt, the raw payload or the log that triggered it. Do NOT enter personal data (names, email addresses, phone numbers, postal addresses), and do NOT enter health, biometric, government-identifier (e.g. SSN) or payment-card data. This text is stored on the agent's governance card and is readable by everyone in the owning organization.
agent_id	string	Optional. The agent the report concerns. Identifier only.
recipeId*	string	The detection recipe the report is filed against (the one that misfired or failed to fire). Identifier only.
checkpoint_id	string	Optional. The related integrity checkpoint, so the reviewer can correlate. Identifier only.

Input schema (JSON)

{
  "type": "object",
  "required": [
    "recipeId",
    "type",
    "summary"
  ],
  "properties": {
    "type": {
      "enum": [
        "fn",
        "fp"
      ],
      "type": "string",
      "description": "`fn` = false negative (the recipe should have fired). `fp` = false positive (it fired on legitimate behaviour)."
    },
    "summary": {
      "type": "string",
      "maxLength": 500,
      "minLength": 1,
      "description": "A short description of what the recipe got wrong — what it flagged, or what it missed, and why that was incorrect. DESCRIBE the misfire; do NOT paste the conversation, the prompt, the raw payload or the log that triggered it. Do NOT enter personal data (names, email addresses, phone numbers, postal addresses), and do NOT enter health, biometric, government-identifier (e.g. SSN) or payment-card data. This text is stored on the agent's governance card and is readable by everyone in the owning organization."
    },
    "agent_id": {
      "type": "string",
      "pattern": "^[A-Za-z0-9][A-Za-z0-9_-]{1,62}[A-Za-z0-9]$",
      "maxLength": 64,
      "minLength": 3,
      "description": "Optional. The agent the report concerns. Identifier only."
    },
    "recipeId": {
      "type": "string",
      "pattern": "^[A-Za-z0-9][A-Za-z0-9_-]{1,62}[A-Za-z0-9]$",
      "maxLength": 64,
      "minLength": 3,
      "description": "The detection recipe the report is filed against (the one that misfired or failed to fire). Identifier only."
    },
    "checkpoint_id": {
      "type": "string",
      "pattern": "^[A-Za-z0-9][A-Za-z0-9_-]{1,62}[A-Za-z0-9]$",
      "maxLength": 64,
      "minLength": 3,
      "description": "Optional. The related integrity checkpoint, so the reviewer can correlate. Identifier only."
    }
  },
  "additionalProperties": false
}

scan_trust

Scan a website's agent-trust-readiness and return a signed scorecard (Trust, plus an Access axis on newer rubrics). Zero-auth. Results are CACHED for up to 24h — check `cached` and `scannedAt` on the result; pass `fresh: true` to force a re-scan (rate-limited). Proxies to the SSRF-locked isittrustready scanner; the Ed25519 signature + permalink are preserved verbatim. Rubric + docs: https://www.isittrustready.ai/rubric and https://docs.mnemom.ai/.

read-only

Argument	Type	Description
url*	string	Domain or URL to scan, e.g. "example.com" or "https://example.com".
fresh	boolean	Force a fresh re-scan instead of the cached result (results are cached up to 24h; the engine rate-limits re-scans). Equivalent to the scanner's rescan flag.

Input schema (JSON)

{
  "type": "object",
  "required": [
    "url"
  ],
  "properties": {
    "url": {
      "type": "string",
      "description": "Domain or URL to scan, e.g. \"example.com\" or \"https://example.com\"."
    },
    "fresh": {
      "type": "boolean",
      "description": "Force a fresh re-scan instead of the cached result (results are cached up to 24h; the engine rate-limits re-scans). Equivalent to the scanner's rescan flag."
    }
  },
  "additionalProperties": false
}

search_reputation_directory

Resolve an agent name or id-prefix to a real agent_id over the PUBLIC reputation directory (only agents whose reputation visibility is public). Zero-auth. The arriving-agent entry point: discover a concrete agent_id, then call get_reputation / verify_reputation on it.

read-only

Argument	Type	Description
q	string	Name search (ilike) or agent-id prefix match.
page	integer	1-based page number for pagination. Default 1.
sort	string	Result ordering. Default "score" (highest-rated first); other supported keys order by recency or name.
grade	string	Filter to one grade (e.g. `AAA`, `B`, `NR`).
per_page	integer	Number of results per page. 1–100, default 20.
confidence	string	Filter to agents at a given reputation-confidence level (driven by how much evidence backs the score).

Input schema (JSON)

{
  "type": "object",
  "properties": {
    "q": {
      "type": "string",
      "description": "Name search (ilike) or agent-id prefix match."
    },
    "page": {
      "type": "integer",
      "default": 1,
      "minimum": 1,
      "description": "1-based page number for pagination. Default 1."
    },
    "sort": {
      "type": "string",
      "default": "score",
      "description": "Result ordering. Default \"score\" (highest-rated first); other supported keys order by recency or name."
    },
    "grade": {
      "type": "string",
      "description": "Filter to one grade (e.g. `AAA`, `B`, `NR`)."
    },
    "per_page": {
      "type": "integer",
      "default": 20,
      "maximum": 100,
      "minimum": 1,
      "description": "Number of results per page. 1–100, default 20."
    },
    "confidence": {
      "enum": [
        "high",
        "medium",
        "low",
        "insufficient"
      ],
      "type": "string",
      "description": "Filter to agents at a given reputation-confidence level (driven by how much evidence backs the score)."
    }
  },
  "additionalProperties": false
}

verify_reputation

Attest an agent's Trust Rating — returns a Merkle-root + hash-chain attestation (hash_chain_valid) proving the rating derives from an unbroken, append-only checkpoint chain, plus a pointer to the signed integrity certificate. This is a chain-integrity attestation, NOT an in-band Ed25519 signature check (that parity is verify_scan, for website scorecards).

read-only

Argument	Type	Description
agent_id*	string	Agent identifier (e.g. smolt-abc123)

Input schema (JSON)

{
  "type": "object",
  "required": [
    "agent_id"
  ],
  "properties": {
    "agent_id": {
      "type": "string",
      "description": "Agent identifier (e.g. smolt-abc123)"
    }
  },
  "additionalProperties": false
}

verify_scan

Verify a website scan scorecard's Ed25519 signature IN-BAND (verify, don't trust). Pass a `scan` (a scorecard from scan_trust) or a `url` to re-scan; returns {verified, key_id, canonicalization} checked against the public key at mnemom://iitr/jwks. Zero-auth. Spec + rubric: https://www.isittrustready.ai/rubric and https://docs.mnemom.ai/.

read-only

Argument	Type	Description
url	string	Alternatively, a domain/URL to re-scan and then verify.
scan	object	A scan scorecard previously returned by scan_trust (or iitr's /r/ JSON), passed back verbatim to verify. Same shape as scan_trust's result; the signature is checked against mnemom://iitr/jwks.

Input schema (JSON)

{
  "type": "object",
  "oneOf": [
    {
      "not": {
        "required": [
          "url"
        ]
      },
      "required": [
        "scan"
      ]
    },
    {
      "not": {
        "required": [
          "scan"
        ]
      },
      "required": [
        "url"
      ]
    }
  ],
  "properties": {
    "url": {
      "type": "string",
      "description": "Alternatively, a domain/URL to re-scan and then verify."
    },
    "scan": {
      "type": "object",
      "required": [
        "schema",
        "target",
        "score",
        "grade",
        "signature"
      ],
      "properties": {
        "grade": {
          "type": "string",
          "description": "Trust letter grade (A+…F)."
        },
        "score": {
          "type": "number",
          "description": "0–100 weighted overall TRUST score."
        },
        "access": {
          "type": "object",
          "properties": {
            "axis": {
              "type": "string",
              "description": "Always \"access\"."
            },
            "grade": {
              "type": "string",
              "description": "Access letter grade (A+…F)."
            },
            "score": {
              "type": "number",
              "description": "0–100 weighted Access/discoverability score (independent of Trust)."
            },
            "version": {
              "type": "string",
              "description": "Access-axis rubric version this sub-score was computed against."
            },
            "applicable": {
              "type": "boolean",
              "description": "False when the site declares Access N/A."
            },
            "categories": {
              "type": "array",
              "items": {
                "type": "object",
                "additionalProperties": true
              },
              "description": "Per-category Access scores + checks."
            }
          },
          "description": "The independent Access/discoverability axis (never blended with Trust). Present from the two-axis rubric (0.3.0+).",
          "additionalProperties": true
        },
        "cached": {
          "type": "boolean",
          "description": "True when served from the scanner's 24h cache rather than a fresh scan."
        },
        "schema": {
          "type": "string",
          "description": "iitr-scan schema version string (e.g. \"iitr-scan/v0.N\")."
        },
        "target": {
          "type": "string",
          "description": "Normalized host that was scanned."
        },
        "permalink": {
          "type": "string",
          "format": "uri",
          "description": "Shareable /r/ permalink (only on /r/ responses; transport field)."
        },
        "scannedAt": {
          "type": "string",
          "format": "date-time",
          "description": "When this scorecard was produced. Results are cached up to 24h — pass fresh:true to scan_trust to force a re-scan."
        },
        "signature": {
          "type": "object",
          "properties": {
            "alg": {
              "type": "string",
              "description": "Always \"Ed25519\"."
            },
            "value": {
              "type": "string",
              "description": "base64 signature."
            },
            "signedAt": {
              "type": "string",
              "format": "date-time",
              "description": "When the scorecard was signed."
            },
            "publicKeyId": {
              "type": "string",
              "description": "16-hex key fingerprint, e.g. 94502b2b7235c986."
            }
          },
          "description": "Ed25519 signature over the canonical result (transport field; stripped before verify).",
          "additionalProperties": true
        },
        "categories": {
          "type": "array",
          "items": {
            "type": "object",
            "additionalProperties": true
          },
          "description": "Trust-axis categories with per-category scores + checks."
        },
        "verification": {
          "type": "object",
          "description": "Self-describing in-band verification block {alg, kid, jwks, canonicalization} — how to verify this scorecard's signature. Self-describing, so signed-EXCLUDED (stripped before verify).",
          "additionalProperties": true
        },
        "rubricVersion": {
          "type": "string",
          "description": "Rubric version (e.g. \"0.4.0\")."
        }
      },
      "description": "A scan scorecard previously returned by scan_trust (or iitr's /r/ JSON), passed back verbatim to verify. Same shape as scan_trust's result; the signature is checked against mnemom://iitr/jwks.",
      "additionalProperties": true
    }
  },
  "additionalProperties": false
}

Input schema (JSON)

{
  "type": "object",
  "required": [
    "agent_id",
    "card_version",
    "autonomy_mode",
    "integrity_mode",
    "principal",
    "values",
    "autonomy",
    "audit"
  ],
  "properties": {
    "audit": {
      "type": "object",
      "required": [
        "retention_days",
        "queryable"
      ],
      "properties": {
        "queryable": {
          "type": "boolean",
          "default": false,
          "description": "Whether those retained records can be queried. Leave false unless you also supply `query_endpoint` — the server rejects a queryable audit policy with no endpoint."
        },
        "query_endpoint": {
          "type": "string",
          "maxLength": 300,
          "description": "HTTPS endpoint the records can be queried from. REQUIRED when `queryable` is true, and ignored when it is false."
        },
        "retention_days": {
          "type": "integer",
          "maximum": 3650,
          "minimum": 0,
          "description": "How many days the agent's decision records are retained. 0 means do not retain. 3650 (10 years) maximum."
        },
        "tamper_evidence": {
          "enum": [
            "append_only",
            "signed",
            "merkle"
          ],
          "type": "string",
          "description": "Tamper-evidence scheme applied to the retained records."
        }
      },
      "description": "How long this agent's own decision log is kept, and whether it can be queried. Required. (This is the agent's audit policy — it is NOT Mnemom's retention policy for the card itself; see the tool's data-handling disclosure for that.)",
      "additionalProperties": false
    },
    "values": {
      "type": "object",
      "required": [
        "declared"
      ],
      "properties": {
        "declared": {
          "type": "array",
          "items": {
            "type": "string",
            "maxLength": 64,
            "minLength": 1
          },
          "maxItems": 32,
          "minItems": 1,
          "description": "Value catalog IDs — e.g. [\"honesty\", \"no_harm\", \"privacy\"]. At least one required, 32 maximum. Short catalog slugs ONLY, never prose and never personal data. (Parameterized value references and long-form value definitions are available on the /v1 REST + CLI path; they are deliberately not exposed here.)"
        }
      },
      "description": "The values this agent declares it is bound by. Required.",
      "additionalProperties": false
    },
    "agent_id": {
      "type": "string",
      "pattern": "^[A-Za-z0-9][A-Za-z0-9_-]{1,62}[A-Za-z0-9]$",
      "maxLength": 64,
      "minLength": 3,
      "description": "The agent this card belongs to (e.g. `smolt-abc123`). Identifier only — never place an API key, a secret, an email address, or any other personal data in this field."
    },
    "autonomy": {
      "type": "object",
      "required": [
        "bounded_actions"
      ],
      "properties": {
        "bounded_actions": {
          "type": "array",
          "items": {
            "type": "string",
            "maxLength": 128,
            "minLength": 1
          },
          "maxItems": 64,
          "minItems": 1,
          "description": "Action names the agent may take within its bounds — e.g. [\"send_email\", \"create_ticket\"]. At least one required. Action identifiers only, not descriptions."
        },
        "forbidden_actions": {
          "type": "array",
          "items": {
            "type": "string",
            "maxLength": 128,
            "minLength": 1
          },
          "maxItems": 64,
          "description": "Action names the agent must never take. Must be disjoint from `bounded_actions`."
        },
        "escalation_triggers": {
          "type": "array",
          "items": {
            "type": "object",
            "required": [
              "condition",
              "action",
              "reason"
            ],
            "properties": {
              "action": {
                "enum": [
                  "escalate",
                  "deny",
                  "log"
                ],
                "type": "string",
                "description": "What to do when the condition holds."
              },
              "reason": {
                "type": "string",
                "maxLength": 200,
                "minLength": 1,
                "description": "Why this trigger exists, in one short sentence. Do NOT enter personal data (names, email addresses, phone numbers, postal addresses), and do NOT enter health, biometric, government-identifier (e.g. SSN) or payment-card data. This text is stored on the agent's governance card and is readable by everyone in the owning organization."
              },
              "condition": {
                "type": "string",
                "maxLength": 200,
                "minLength": 1,
                "description": "The condition, as a short expression or slug (e.g. \"amount > 1000\"). Short condition only — never paste a conversation, a log excerpt, or a record about a person. Do NOT enter personal data (names, email addresses, phone numbers, postal addresses), and do NOT enter health, biometric, government-identifier (e.g. SSN) or payment-card data. This text is stored on the agent's governance card and is readable by everyone in the owning organization."
              }
            },
            "additionalProperties": false
          },
          "maxItems": 32,
          "description": "Conditions that route to a human instead of acting."
        }
      },
      "description": "What the agent may do on its own authority. Required.",
      "additionalProperties": false
    },
    "principal": {
      "type": "object",
      "required": [
        "type",
        "relationship",
        "identifier"
      ],
      "properties": {
        "type": {
          "enum": [
            "human",
            "organization",
            "agent",
            "unspecified"
          ],
          "type": "string",
          "description": "The kind of principal the agent answers to."
        },
        "identifier": {
          "type": "string",
          "maxLength": 128,
          "minLength": 1,
          "description": "Who the principal is. Use a ROLE or ORGANIZATION name (\"support-team\", \"Acme Corp Finance\"), NOT an individual's name, email address or phone number. Pass \"unspecified\" if there is no named principal. Do NOT enter personal data (names, email addresses, phone numbers, postal addresses), and do NOT enter health, biometric, government-identifier (e.g. SSN) or payment-card data. This text is stored on the agent's governance card and is readable by everyone in the owning organization."
        },
        "relationship": {
          "enum": [
            "delegated_authority",
            "advisory",
            "autonomous"
          ],
          "type": "string",
          "description": "How the agent relates to that principal."
        },
        "escalation_contact": {
          "type": "string",
          "maxLength": 128,
          "minLength": 1,
          "description": "Where an escalation is routed. Use a ROLE ALIAS or SHARED INBOX (\"oncall-sre\", \"[email protected]\"), never an individual's personal contact details. Do NOT enter personal data (names, email addresses, phone numbers, postal addresses), and do NOT enter health, biometric, government-identifier (e.g. SSN) or payment-card data. This text is stored on the agent's governance card and is readable by everyone in the owning organization."
        }
      },
      "description": "Whose authority this agent acts under. Required.",
      "additionalProperties": false
    },
    "card_version": {
      "type": "string",
      "pattern": "^[A-Za-z0-9][A-Za-z0-9._/-]{1,38}[A-Za-z0-9]$",
      "maxLength": 40,
      "minLength": 3,
      "description": "Card schema version. REQUIRED by the server-side validator. Current canonical value: `unified/2026-04-26`."
    },
    "autonomy_mode": {
      "enum": [
        "off",
        "observe",
        "nudge",
        "enforce"
      ],
      "type": "string",
      "description": "Master switch for the action-policing pipeline. Required. `off` disables it; `observe` records only; `nudge` warns; `enforce` blocks."
    },
    "integrity_mode": {
      "enum": [
        "off",
        "observe",
        "nudge",
        "enforce"
      ],
      "type": "string",
      "description": "Master switch for the values pipeline. Required. Same four states as `autonomy_mode`."
    }
  },
  "additionalProperties": false
}

Input schema (JSON)

{
  "type": "object",
  "required": [
    "agent_id",
    "card_version",
    "mode",
    "thresholds",
    "screen_surfaces",
    "trusted_sources"
  ],
  "properties": {
    "mode": {
      "enum": [
        "off",
        "observe",
        "nudge",
        "enforce"
      ],
      "type": "string",
      "description": "Screening mode for the protection pipeline. Required. `off` disables screening; `observe` records only; `nudge` warns; `enforce` blocks."
    },
    "agent_id": {
      "type": "string",
      "pattern": "^[A-Za-z0-9][A-Za-z0-9_-]{1,62}[A-Za-z0-9]$",
      "maxLength": 64,
      "minLength": 3,
      "description": "The agent this card belongs to (e.g. `smolt-abc123`). Identifier only — never place an API key, a secret, an email address, or any other personal data in this field."
    },
    "thresholds": {
      "type": "object",
      "required": [
        "warn",
        "quarantine",
        "block"
      ],
      "properties": {
        "warn": {
          "type": "number",
          "maximum": 1,
          "minimum": 0,
          "description": "Score at or above which the request is flagged."
        },
        "block": {
          "type": "number",
          "maximum": 1,
          "minimum": 0,
          "description": "Score at or above which the request is refused."
        },
        "quarantine": {
          "type": "number",
          "maximum": 1,
          "minimum": 0,
          "description": "Score at or above which the request is held for review."
        }
      },
      "description": "Risk-score cutoffs, each in [0, 1] and ordered warn ≤ quarantine ≤ block. Required. Send the full set: a publish replaces the agent's current card rather than patching it.",
      "additionalProperties": false
    },
    "card_version": {
      "type": "string",
      "pattern": "^[A-Za-z0-9][A-Za-z0-9._/-]{1,38}[A-Za-z0-9]$",
      "maxLength": 40,
      "minLength": 3,
      "description": "Card schema version. REQUIRED by the server-side validator. Current canonical value: `protection/2026-04-26`."
    },
    "screen_surfaces": {
      "type": "object",
      "required": [
        "incoming",
        "outgoing",
        "tool_calls",
        "tool_responses"
      ],
      "properties": {
        "incoming": {
          "type": "boolean",
          "description": "Screen prompts arriving at the agent."
        },
        "outgoing": {
          "type": "boolean",
          "description": "Screen the agent's outbound messages."
        },
        "tool_calls": {
          "type": "boolean",
          "description": "Screen the tool calls the agent makes."
        },
        "tool_responses": {
          "type": "boolean",
          "description": "Screen tool responses returned to the agent."
        }
      },
      "description": "Which traffic surfaces are screened. Required, with all four flags set.",
      "additionalProperties": false
    },
    "trusted_sources": {
      "type": "object",
      "required": [
        "domains",
        "agent_ids",
        "ip_ranges"
      ],
      "properties": {
        "domains": {
          "type": "array",
          "items": {
            "type": "string",
            "maxLength": 253,
            "minLength": 3
          },
          "maxItems": 64,
          "description": "Trusted DNS names, optionally with `:port`. No wildcards."
        },
        "agent_ids": {
          "type": "array",
          "items": {
            "type": "string",
            "pattern": "^mnm-[A-Za-z0-9-]{4,}$",
            "maxLength": 64,
            "minLength": 8
          },
          "maxItems": 64,
          "description": "Trusted Mnemom agent IDs. Must be in canonical `mnm-*` form."
        },
        "ip_ranges": {
          "type": "array",
          "items": {
            "type": "string",
            "maxLength": 43,
            "minLength": 4
          },
          "maxItems": 64,
          "description": "Trusted CIDR ranges (e.g. `10.0.0.0/8`)."
        }
      },
      "description": "Sources exempt from screening. Required, with all three lists present; send empty lists to trust nothing extra. Enumerate specific hosts — wildcards are rejected, and a server-side deny-list (public LLM/DNS endpoints, 0.0.0.0/0, ::/0, link-local, multicast) is always applied.",
      "additionalProperties": false
    },
    "protected_surface": {
      "type": "object",
      "properties": {
        "assets": {
          "type": "array",
          "items": {
            "type": "object",
            "required": [
              "kind",
              "selector"
            ],
            "properties": {
              "kind": {
                "type": "string",
                "maxLength": 64,
                "minLength": 1,
                "description": "Asset class — e.g. \"repo\", \"database\", \"bucket\"."
              },
              "label": {
                "type": "string",
                "maxLength": 120,
                "minLength": 1,
                "description": "Short human-readable name for the asset."
              },
              "reason": {
                "type": "string",
                "maxLength": 200,
                "minLength": 1,
                "description": "Why it is protected, in one short sentence. Do NOT enter personal data (names, email addresses, phone numbers, postal addresses), and do NOT enter health, biometric, government-identifier (e.g. SSN) or payment-card data. This text is stored on the agent's governance card and is readable by everyone in the owning organization."
              },
              "selector": {
                "type": "string",
                "maxLength": 256,
                "minLength": 1,
                "description": "Which instance — e.g. \"mnemom/mnemom-api\". A resource identifier only: no credentials, no connection strings, no personal data."
              }
            },
            "additionalProperties": false
          },
          "maxItems": 64,
          "description": "The assets under protection."
        },
        "escalation_required": {
          "type": "array",
          "items": {
            "type": "object",
            "required": [
              "pattern"
            ],
            "properties": {
              "reason": {
                "type": "string",
                "maxLength": 200,
                "minLength": 1,
                "description": "Why this entry exists, in one short sentence. Do NOT enter personal data (names, email addresses, phone numbers, postal addresses), and do NOT enter health, biometric, government-identifier (e.g. SSN) or payment-card data. This text is stored on the agent's governance card and is readable by everyone in the owning organization."
              },
              "pattern": {
                "type": "string",
                "maxLength": 200,
                "minLength": 1,
                "description": "Operation matcher — e.g. \"force_push\", \"drop_table*\". A short pattern, not a description."
              },
              "applies_to": {
                "type": "array",
                "items": {
                  "type": "string",
                  "maxLength": 256,
                  "minLength": 1
                },
                "maxItems": 64,
                "description": "Asset identities this entry applies to. Omit to apply to every protected asset."
              }
            },
            "additionalProperties": false
          },
          "maxItems": 64,
          "description": "Operations that require human approval before the agent may proceed."
        },
        "forbidden_operations": {
          "type": "array",
          "items": {
            "type": "object",
            "required": [
              "pattern"
            ],
            "properties": {
              "reason": {
                "type": "string",
                "maxLength": 200,
                "minLength": 1,
                "description": "Why this entry exists, in one short sentence. Do NOT enter personal data (names, email addresses, phone numbers, postal addresses), and do NOT enter health, biometric, government-identifier (e.g. SSN) or payment-card data. This text is stored on the agent's governance card and is readable by everyone in the owning organization."
              },
              "pattern": {
                "type": "string",
                "maxLength": 200,
                "minLength": 1,
                "description": "Operation matcher — e.g. \"force_push\", \"drop_table*\". A short pattern, not a description."
              },
              "severity": {
                "enum": [
                  "low",
                  "medium",
                  "high",
                  "critical"
                ],
                "type": "string",
                "description": "How serious a violation of this entry is."
              },
              "applies_to": {
                "type": "array",
                "items": {
                  "type": "string",
                  "maxLength": 256,
                  "minLength": 1
                },
                "maxItems": 64,
                "description": "Asset identities this entry applies to. Omit to apply to every protected asset."
              }
            },
            "additionalProperties": false
          },
          "maxItems": 64,
          "description": "Operations the agent must never perform on the protected assets."
        }
      },
      "description": "The assets and operations this agent must protect. Omit to accept the composed default (empty surface).",
      "additionalProperties": false
    }
  },
  "additionalProperties": false
}

Input schema (JSON)

{
  "type": "object",
  "required": [
    "agent_id",
    "card_version",
    "autonomy_mode",
    "integrity_mode",
    "principal",
    "values",
    "autonomy",
    "audit"
  ],
  "properties": {
    "audit": {
      "type": "object",
      "required": [
        "retention_days",
        "queryable"
      ],
      "properties": {
        "queryable": {
          "type": "boolean",
          "default": false,
          "description": "Whether those retained records can be queried. Leave false unless you also supply `query_endpoint` — the server rejects a queryable audit policy with no endpoint."
        },
        "query_endpoint": {
          "type": "string",
          "maxLength": 300,
          "description": "HTTPS endpoint the records can be queried from. REQUIRED when `queryable` is true, and ignored when it is false."
        },
        "retention_days": {
          "type": "integer",
          "maximum": 3650,
          "minimum": 0,
          "description": "How many days the agent's decision records are retained. 0 means do not retain. 3650 (10 years) maximum."
        },
        "tamper_evidence": {
          "enum": [
            "append_only",
            "signed",
            "merkle"
          ],
          "type": "string",
          "description": "Tamper-evidence scheme applied to the retained records."
        }
      },
      "description": "How long this agent's own decision log is kept, and whether it can be queried. Required. (This is the agent's audit policy — it is NOT Mnemom's retention policy for the card itself; see the tool's data-handling disclosure for that.)",
      "additionalProperties": false
    },
    "values": {
      "type": "object",
      "required": [
        "declared"
      ],
      "properties": {
        "declared": {
          "type": "array",
          "items": {
            "type": "string",
            "maxLength": 64,
            "minLength": 1
          },
          "maxItems": 32,
          "minItems": 1,
          "description": "Value catalog IDs — e.g. [\"honesty\", \"no_harm\", \"privacy\"]. At least one required, 32 maximum. Short catalog slugs ONLY, never prose and never personal data. (Parameterized value references and long-form value definitions are available on the /v1 REST + CLI path; they are deliberately not exposed here.)"
        }
      },
      "description": "The values this agent declares it is bound by. Required.",
      "additionalProperties": false
    },
    "agent_id": {
      "type": "string",
      "pattern": "^[A-Za-z0-9][A-Za-z0-9_-]{1,62}[A-Za-z0-9]$",
      "maxLength": 64,
      "minLength": 3,
      "description": "The agent this card belongs to (e.g. `smolt-abc123`). Identifier only — never place an API key, a secret, an email address, or any other personal data in this field."
    },
    "autonomy": {
      "type": "object",
      "required": [
        "bounded_actions"
      ],
      "properties": {
        "bounded_actions": {
          "type": "array",
          "items": {
            "type": "string",
            "maxLength": 128,
            "minLength": 1
          },
          "maxItems": 64,
          "minItems": 1,
          "description": "Action names the agent may take within its bounds — e.g. [\"send_email\", \"create_ticket\"]. At least one required. Action identifiers only, not descriptions."
        },
        "forbidden_actions": {
          "type": "array",
          "items": {
            "type": "string",
            "maxLength": 128,
            "minLength": 1
          },
          "maxItems": 64,
          "description": "Action names the agent must never take. Must be disjoint from `bounded_actions`."
        },
        "escalation_triggers": {
          "type": "array",
          "items": {
            "type": "object",
            "required": [
              "condition",
              "action",
              "reason"
            ],
            "properties": {
              "action": {
                "enum": [
                  "escalate",
                  "deny",
                  "log"
                ],
                "type": "string",
                "description": "What to do when the condition holds."
              },
              "reason": {
                "type": "string",
                "maxLength": 200,
                "minLength": 1,
                "description": "Why this trigger exists, in one short sentence. Do NOT enter personal data (names, email addresses, phone numbers, postal addresses), and do NOT enter health, biometric, government-identifier (e.g. SSN) or payment-card data. This text is stored on the agent's governance card and is readable by everyone in the owning organization."
              },
              "condition": {
                "type": "string",
                "maxLength": 200,
                "minLength": 1,
                "description": "The condition, as a short expression or slug (e.g. \"amount > 1000\"). Short condition only — never paste a conversation, a log excerpt, or a record about a person. Do NOT enter personal data (names, email addresses, phone numbers, postal addresses), and do NOT enter health, biometric, government-identifier (e.g. SSN) or payment-card data. This text is stored on the agent's governance card and is readable by everyone in the owning organization."
              }
            },
            "additionalProperties": false
          },
          "maxItems": 32,
          "description": "Conditions that route to a human instead of acting."
        }
      },
      "description": "What the agent may do on its own authority. Required.",
      "additionalProperties": false
    },
    "principal": {
      "type": "object",
      "required": [
        "type",
        "relationship",
        "identifier"
      ],
      "properties": {
        "type": {
          "enum": [
            "human",
            "organization",
            "agent",
            "unspecified"
          ],
          "type": "string",
          "description": "The kind of principal the agent answers to."
        },
        "identifier": {
          "type": "string",
          "maxLength": 128,
          "minLength": 1,
          "description": "Who the principal is. Use a ROLE or ORGANIZATION name (\"support-team\", \"Acme Corp Finance\"), NOT an individual's name, email address or phone number. Pass \"unspecified\" if there is no named principal. Do NOT enter personal data (names, email addresses, phone numbers, postal addresses), and do NOT enter health, biometric, government-identifier (e.g. SSN) or payment-card data. This text is stored on the agent's governance card and is readable by everyone in the owning organization."
        },
        "relationship": {
          "enum": [
            "delegated_authority",
            "advisory",
            "autonomous"
          ],
          "type": "string",
          "description": "How the agent relates to that principal."
        },
        "escalation_contact": {
          "type": "string",
          "maxLength": 128,
          "minLength": 1,
          "description": "Where an escalation is routed. Use a ROLE ALIAS or SHARED INBOX (\"oncall-sre\", \"[email protected]\"), never an individual's personal contact details. Do NOT enter personal data (names, email addresses, phone numbers, postal addresses), and do NOT enter health, biometric, government-identifier (e.g. SSN) or payment-card data. This text is stored on the agent's governance card and is readable by everyone in the owning organization."
        }
      },
      "description": "Whose authority this agent acts under. Required.",
      "additionalProperties": false
    },
    "card_version": {
      "type": "string",
      "pattern": "^[A-Za-z0-9][A-Za-z0-9._/-]{1,38}[A-Za-z0-9]$",
      "maxLength": 40,
      "minLength": 3,
      "description": "Card schema version. REQUIRED by the server-side validator. Current canonical value: `unified/2026-04-26`."
    },
    "autonomy_mode": {
      "enum": [
        "off",
        "observe",
        "nudge",
        "enforce"
      ],
      "type": "string",
      "description": "Master switch for the action-policing pipeline. Required. `off` disables it; `observe` records only; `nudge` warns; `enforce` blocks."
    },
    "integrity_mode": {
      "enum": [
        "off",
        "observe",
        "nudge",
        "enforce"
      ],
      "type": "string",
      "description": "Master switch for the values pipeline. Required. Same four states as `autonomy_mode`."
    }
  },
  "additionalProperties": false
}

Input schema (JSON)

{
  "type": "object",
  "required": [
    "agent_id",
    "card_version",
    "mode",
    "thresholds",
    "screen_surfaces",
    "trusted_sources"
  ],
  "properties": {
    "mode": {
      "enum": [
        "off",
        "observe",
        "nudge",
        "enforce"
      ],
      "type": "string",
      "description": "Screening mode for the protection pipeline. Required. `off` disables screening; `observe` records only; `nudge` warns; `enforce` blocks."
    },
    "agent_id": {
      "type": "string",
      "pattern": "^[A-Za-z0-9][A-Za-z0-9_-]{1,62}[A-Za-z0-9]$",
      "maxLength": 64,
      "minLength": 3,
      "description": "The agent this card belongs to (e.g. `smolt-abc123`). Identifier only — never place an API key, a secret, an email address, or any other personal data in this field."
    },
    "thresholds": {
      "type": "object",
      "required": [
        "warn",
        "quarantine",
        "block"
      ],
      "properties": {
        "warn": {
          "type": "number",
          "maximum": 1,
          "minimum": 0,
          "description": "Score at or above which the request is flagged."
        },
        "block": {
          "type": "number",
          "maximum": 1,
          "minimum": 0,
          "description": "Score at or above which the request is refused."
        },
        "quarantine": {
          "type": "number",
          "maximum": 1,
          "minimum": 0,
          "description": "Score at or above which the request is held for review."
        }
      },
      "description": "Risk-score cutoffs, each in [0, 1] and ordered warn ≤ quarantine ≤ block. Required. Send the full set: a publish replaces the agent's current card rather than patching it.",
      "additionalProperties": false
    },
    "card_version": {
      "type": "string",
      "pattern": "^[A-Za-z0-9][A-Za-z0-9._/-]{1,38}[A-Za-z0-9]$",
      "maxLength": 40,
      "minLength": 3,
      "description": "Card schema version. REQUIRED by the server-side validator. Current canonical value: `protection/2026-04-26`."
    },
    "screen_surfaces": {
      "type": "object",
      "required": [
        "incoming",
        "outgoing",
        "tool_calls",
        "tool_responses"
      ],
      "properties": {
        "incoming": {
          "type": "boolean",
          "description": "Screen prompts arriving at the agent."
        },
        "outgoing": {
          "type": "boolean",
          "description": "Screen the agent's outbound messages."
        },
        "tool_calls": {
          "type": "boolean",
          "description": "Screen the tool calls the agent makes."
        },
        "tool_responses": {
          "type": "boolean",
          "description": "Screen tool responses returned to the agent."
        }
      },
      "description": "Which traffic surfaces are screened. Required, with all four flags set.",
      "additionalProperties": false
    },
    "trusted_sources": {
      "type": "object",
      "required": [
        "domains",
        "agent_ids",
        "ip_ranges"
      ],
      "properties": {
        "domains": {
          "type": "array",
          "items": {
            "type": "string",
            "maxLength": 253,
            "minLength": 3
          },
          "maxItems": 64,
          "description": "Trusted DNS names, optionally with `:port`. No wildcards."
        },
        "agent_ids": {
          "type": "array",
          "items": {
            "type": "string",
            "pattern": "^mnm-[A-Za-z0-9-]{4,}$",
            "maxLength": 64,
            "minLength": 8
          },
          "maxItems": 64,
          "description": "Trusted Mnemom agent IDs. Must be in canonical `mnm-*` form."
        },
        "ip_ranges": {
          "type": "array",
          "items": {
            "type": "string",
            "maxLength": 43,
            "minLength": 4
          },
          "maxItems": 64,
          "description": "Trusted CIDR ranges (e.g. `10.0.0.0/8`)."
        }
      },
      "description": "Sources exempt from screening. Required, with all three lists present; send empty lists to trust nothing extra. Enumerate specific hosts — wildcards are rejected, and a server-side deny-list (public LLM/DNS endpoints, 0.0.0.0/0, ::/0, link-local, multicast) is always applied.",
      "additionalProperties": false
    },
    "protected_surface": {
      "type": "object",
      "properties": {
        "assets": {
          "type": "array",
          "items": {
            "type": "object",
            "required": [
              "kind",
              "selector"
            ],
            "properties": {
              "kind": {
                "type": "string",
                "maxLength": 64,
                "minLength": 1,
                "description": "Asset class — e.g. \"repo\", \"database\", \"bucket\"."
              },
              "label": {
                "type": "string",
                "maxLength": 120,
                "minLength": 1,
                "description": "Short human-readable name for the asset."
              },
              "reason": {
                "type": "string",
                "maxLength": 200,
                "minLength": 1,
                "description": "Why it is protected, in one short sentence. Do NOT enter personal data (names, email addresses, phone numbers, postal addresses), and do NOT enter health, biometric, government-identifier (e.g. SSN) or payment-card data. This text is stored on the agent's governance card and is readable by everyone in the owning organization."
              },
              "selector": {
                "type": "string",
                "maxLength": 256,
                "minLength": 1,
                "description": "Which instance — e.g. \"mnemom/mnemom-api\". A resource identifier only: no credentials, no connection strings, no personal data."
              }
            },
            "additionalProperties": false
          },
          "maxItems": 64,
          "description": "The assets under protection."
        },
        "escalation_required": {
          "type": "array",
          "items": {
            "type": "object",
            "required": [
              "pattern"
            ],
            "properties": {
              "reason": {
                "type": "string",
                "maxLength": 200,
                "minLength": 1,
                "description": "Why this entry exists, in one short sentence. Do NOT enter personal data (names, email addresses, phone numbers, postal addresses), and do NOT enter health, biometric, government-identifier (e.g. SSN) or payment-card data. This text is stored on the agent's governance card and is readable by everyone in the owning organization."
              },
              "pattern": {
                "type": "string",
                "maxLength": 200,
                "minLength": 1,
                "description": "Operation matcher — e.g. \"force_push\", \"drop_table*\". A short pattern, not a description."
              },
              "applies_to": {
                "type": "array",
                "items": {
                  "type": "string",
                  "maxLength": 256,
                  "minLength": 1
                },
                "maxItems": 64,
                "description": "Asset identities this entry applies to. Omit to apply to every protected asset."
              }
            },
            "additionalProperties": false
          },
          "maxItems": 64,
          "description": "Operations that require human approval before the agent may proceed."
        },
        "forbidden_operations": {
          "type": "array",
          "items": {
            "type": "object",
            "required": [
              "pattern"
            ],
            "properties": {
              "reason": {
                "type": "string",
                "maxLength": 200,
                "minLength": 1,
                "description": "Why this entry exists, in one short sentence. Do NOT enter personal data (names, email addresses, phone numbers, postal addresses), and do NOT enter health, biometric, government-identifier (e.g. SSN) or payment-card data. This text is stored on the agent's governance card and is readable by everyone in the owning organization."
              },
              "pattern": {
                "type": "string",
                "maxLength": 200,
                "minLength": 1,
                "description": "Operation matcher — e.g. \"force_push\", \"drop_table*\". A short pattern, not a description."
              },
              "severity": {
                "enum": [
                  "low",
                  "medium",
                  "high",
                  "critical"
                ],
                "type": "string",
                "description": "How serious a violation of this entry is."
              },
              "applies_to": {
                "type": "array",
                "items": {
                  "type": "string",
                  "maxLength": 256,
                  "minLength": 1
                },
                "maxItems": 64,
                "description": "Asset identities this entry applies to. Omit to apply to every protected asset."
              }
            },
            "additionalProperties": false
          },
          "maxItems": 64,
          "description": "Operations the agent must never perform on the protected assets."
        }
      },
      "description": "The assets and operations this agent must protect. Omit to accept the composed default (empty surface).",
      "additionalProperties": false
    }
  },
  "additionalProperties": false
}