Agents

Agents is the runtime and release workspace at /workflow-runtime. Route access requires workflow:read unless a full-access role applies.

What it owns

• Agent identity, owner, model, tool permissions, input contract, and output contract.
• Draft agent configuration and immutable Releases.
• Environment-specific Rollouts and Rollback to a published Release.
• Runtime executions, health, policy binding, sampling configuration, and the agent assurance score.
• Agent detail tabs: Definition, Releases, Runs, Log, Sampling, and Policy.
• Read-only compiled workflow diagnostics for published Process specifications.

Production execution requires a published Release, an active Rollout, and a governance binding. The execution API rejects a production run that misses any of the three. Ungoverned execution is limited to an explicitly marked sandbox path, and every run the workspace can start today is a sandbox run.

The Releases tab provides controls to publish a Draft, promote a published Release to production, and roll production back to a prior Release. Each control opens a confirmation dialog and calls its own API mutation, with that mutation's authorization and lifecycle rules. Promotion and Rollback require a production governance binding. A production change that replaces a serving Release also waits for an available manifest comparison. Rollback requires a reason. A published Release remains immutable in the database.

A pending sampling-change request is approved or rejected through approveSamplingChange. The procedure requires Agent update permission and denies an approver whose identity matches the request's requester. The sampling-update procedure carries no override to apply a pending change immediately.

Release lifecycle

flowchart LR
  D["Draft configuration"] --> V["Validate"]
  V --> R["Publish immutable Release"]
  R --> O["Rollout to environment"]
  O --> X["Execution records"]
  O --> B["Rollback to prior Release"]

Every execution keeps the Release and Rollout identifiers needed by Lineage Explorer and Evidence Room. A later edit produces a new Release.

Boundaries

Processes owns multi-step stages, handlers, typed handoffs, checkpoints, and publication. The compiled workflow panel in Agents is a technical diagnostic with no create, edit, publish, or deploy controls.

Mutating actions apply resource authorization in addition to the route-level read gate.