<\/span><\/h3>\nBefore sending, the current owner runs a preflight check. It confirms that the payload is complete, fresh, and safe to transfer.<\/p>\n
Sender preflight checklist:<\/strong><\/p>\n\n- The objective is specific and still relevant.<\/li>\n
- The completed work is separated from assumptions.<\/li>\n
- Evidence includes timestamps and stable references.<\/li>\n
- Known gaps and failed checks are explicit.<\/li>\n
- The requested next action has one clear owner.<\/li>\n
- Authority boundaries match the workflow phase.<\/li>\n
- The expiry time reflects how quickly state can change.<\/li>\n
- The idempotency key covers every possible side effect.<\/li>\n
- The fallback owner is available through a defined channel.<\/li>\n<\/ul>\n
The sender then marks the work as handoff_pending<\/code>. It retains responsibility until an acceptance arrives. Therefore, a dropped message cannot create ownerless work.<\/p>\n<\/span>Phase Two: The Receiver Accepts or Rejects<\/span><\/h3>\nThe receiver validates the contract before acting. It should not silently repair important omissions because that hides interface defects.<\/p>\n
Receiver acceptance checklist:<\/strong><\/p>\n\n- The contract version is supported.<\/li>\n
- Required fields exist and use valid types.<\/li>\n
- The handoff and run identifiers are unique and traceable.<\/li>\n
- Evidence is accessible and has not expired.<\/li>\n
- Preconditions still match current system state.<\/li>\n
- The requested action fits the receiver\u2019s assigned role.<\/li>\n
- Granted tools are sufficient but not excessive.<\/li>\n
- Required approvals are valid for this exact action.<\/li>\n
- The idempotency key has not already completed.<\/li>\n<\/ul>\n
If every check passes, the receiver emits an acceptance record and becomes the owner. Otherwise, it rejects the handoff with a machine-readable reason.<\/p>\n
Useful rejection codes include schema_unsupported<\/code>, stale_context<\/code>, missing_evidence<\/code>, insufficient_authority<\/code>, and precondition_failed<\/code>. Specific codes support routing, alerting, and evaluation.<\/p>\n<\/span>Incident Response Example: Four Agents, One Controlled Path<\/span><\/h2>\nConsider a checkout outage handled by four specialized agents. The workflow includes triage, diagnosis, approval, and remediation.<\/p>\n
\n- Triage agent:<\/strong> Correlates alerts, confirms customer impact, and opens a run.<\/li>\n
- Diagnostic agent:<\/strong> Queries logs and metrics, then ranks plausible causes.<\/li>\n
- Approval agent:<\/strong> Applies policy and routes consequential changes to an authorized person.<\/li>\n
- Remediation agent:<\/strong> Executes only the approved change, then verifies service health.<\/li>\n<\/ol>\n
The triage agent transfers an incident summary, affected services, and evidence references. The diagnostic agent accepts only if timestamps remain fresh. It then investigates with read-only tools.<\/p>\n
Suppose the diagnostic agent suspects connection pool exhaustion. It hands off a proposed restart, but it cannot authorize execution. The approval phase checks the blast radius, rollback plan, environment, and on-call policy.<\/p>\n
After approval, the remediation agent receives a new contract. That contract identifies the approved command, target resource, approval identity, expiration, and idempotency key. It rejects any material mismatch.<\/p>\n
Finally, the remediation agent verifies health against explicit criteria. It must not stop after a successful tool response. A completed command and a restored service are different outcomes.<\/p>\n
Current incident-management guidance emphasizes phase-specific permissions, approvals, and deterministic stopping. The production architecture patterns<\/a> described by Augment Code reinforce this approach.<\/p>\n<\/span>Bound Permissions to the Workflow Phase<\/span><\/h2>\nTool access should follow the task phase. A diagnostic agent rarely needs write access. Likewise, an approval agent may evaluate policy without operating infrastructure.<\/p>\n
A practical permission model separates four levels:<\/p>\n