Agent Manifest

Contents

Why a manifest

Capability is declared, not requested.

An instruction in a prompt is a preference. The model may follow it. That is not a control.

A manifest is enforced by the runtime. If an agent has not declared a write path, the runtime does not have one to give it.

In a regulated industry this distinction is the entire product.

The six sections

Read and write are declared separately.

Identity: Name, industry, role, version.
can_read: Named sources. Read only, always.
can_reason_about: The decisions and metrics inside its scope.
can_recommend: What it may propose. Proposals are not actions.
can_execute: Named write paths in named systems.
requires_human_approval: What it may never do alone, whatever it concludes.

An agent that reads CRM does not thereby write to it.

Worked example

Commercial Excellence Agent, pharmaceutical.

commercial-excellence.agent.yaml

agent:      commercial_excellence
industry:   pharmaceutical
role:       commercial_intelligence
version:    1.2

can_read:
  crm
  rx_data
  hcp_master
  brand_plans

can_reason_about:
  territory_performance
  hcp_opportunity
  brand_growth

can_recommend:
  hcp_prioritisation
  territory_actions
  next_best_action

can_execute:
  crm_task_create
  call_plan_generate

requires_human_approval:  external_communications  material_strategy_changes  incentive_change  promotional_claim

Every agent declares its boundary. In a regulated industry that boundary is the product.

How the runtime uses it

Four points of enforcement.

Before reasoning: Sources outside can_read are not resolvable. The agent cannot see them.
During reasoning: Rules in the ontology marked enforcement: block apply to recommendations, not just actions.
Before execution: Any action inside requires_human_approval is held and routed to a named human.
After execution: The action is written with the agent identity, the approving human, and the reasoning trace.

None of these steps depends on the model behaving well.

Versioning and change

Widening a boundary is a major version.

Manifests are versioned. Widening can_execute or narrowing requires_human_approval is a major version change and requires re-approval.

Change history is retained. If an agent took an action last quarter, the manifest it was operating under is still readable.

Common mistakes

Four that recur.

Declaring a system rather than a path: can_execute: veeva grants everything. Name the action.
Approval lists written after launch: The approval boundary is designed with the agent, not bolted on.
One agent that does everything: Broad scope makes approval boundaries meaningless. Split the agent.
Recommendation treated as action: A recommendation is an output. If it reaches a customer, it was an action.

Where to go from here.

Plate data

Spec: Super Brain
Part: 03 of 03
Sections: 06
Version: 1.0

Writing manifests for a regulated industry?

This is the part most teams get wrong on the first attempt. We have made those mistakes already.

Talk to us

A conversation, not a demo script. We ask what your systems of record are, what they cannot answer, and which decisions actually matter. If an Industry OS is not the right answer for you, we will say so.