Check before your AI agent acts

The four answers

ALLOWED_TO_PREPARE

Every requirement is met. The agent may prepare; anything external still needs a connector after approval.

HUMAN_APPROVAL_REQUIRED

Preparation may go ahead, but the action leaves the workspace and waits for the owner to approve its exact hash.

BLOCKED

A requirement is missing or wrong: authority, permission, budget, currency, target, expiry, scope, a mismatched or expired approval, or a replayed key.

UNAVAILABLE

The check itself could not complete (for example the replay store did not answer). Not a permission.

Never a generic “safe” or “approved”: every answer names its reason codes, and an answer the evidence does not justify is not given.

How Jithox’s own four teams use it

Deterministic demonstrations, evaluated on a fixed clock. Nothing here was published, submitted, tested or paid.

• Commerce

  Publish a EUR 29 product on Payhip

  The Commerce bot has assembled the listing. Publishing puts a price in front of the public, so the owner approves the exact listing hash first.

  HUMAN_APPROVAL_REQUIRED

  external_execution_unsupported · no_standing_budget · approval_missing · reversibility_unknown

• First Cash

  Prepare a freelance proposal

  Drafting a proposal changes nothing outside the workspace, so the bot may prepare it now.

  ALLOWED_TO_PREPARE

  no reason codes

• First Cash

  Submit the proposal

  Submission reaches a real client and cannot be unsent; it waits for the owner's approval of that exact submission.

  HUMAN_APPROVAL_REQUIRED

  external_execution_unsupported · approval_missing · irreversible_requires_approval

• Security

  Inspect a customer's ZIP offline

  Inspection is allowed only because the customer's scope is recorded and immutable; nothing live is touched.

  ALLOWED_TO_PREPARE

  no reason codes

• Security

  Test a customer target without authorization

  No standing grant with a recorded scope and expiry exists, so external testing is blocked outright.

  BLOCKED

  external_execution_unsupported · authority_missing · approval_missing · reversibility_unknown · data_classification_requires_approval

• Growth

  Draft a social post

  A draft stays in the workspace, so the Growth bot may prepare it.

  ALLOWED_TO_PREPARE

  no reason codes

• Growth

  Publish the post automatically

  The bot holds no publish permission and no standing grant, so automatic publication is blocked, not merely queued for approval.

  BLOCKED

  permission_missing · external_execution_unsupported · approval_missing · reversibility_unknown

For developers and agents

Three versioned, compute-only routes. The schema document carries the closed request and result schemas, the twelve action types with their policy facts, the reason codes, the MCP tool contract for the fleet, and the client snippets below.

GET /api/agent-preflight/v1/schema

Schemas, action types, decisions, reason codes, limits, MCP tool contract, client exports.

POST /api/agent-preflight/v1/evaluate

One planned action in; one bounded decision with reasons, missing requirements and a hash-bound receipt out. no-store.

GET /api/agent-preflight/v1/fixtures

The seven team demonstrations with their evaluated results.

Connect the result to the agent you use

• Claude Code CONFIG READY

  Add the rule below to the project's CLAUDE.md. Claude Code runs the curl through its Bash tool and reads the decision before it drafts or asks for approval.

  CLAUDE.md

  ## Jithox Agent Action Preflight
  
  Before any action that sends, publishes, buys, submits, accepts, tests or changes something outside the workspace:
  1. POST the planned action to https://jithox.com/api/agent-preflight/v1/evaluate (schema: https://jithox.com/api/agent-preflight/v1/schema).
  2. Act only on ALLOWED_TO_PREPARE. On HUMAN_APPROVAL_REQUIRED, show the owner the actionHash and stop. On BLOCKED or UNAVAILABLE, stop and report the reason codes.
  3. Never execute the external step yourself; Jithox does not execute either. Hand an approved hash to the official connector.
  4. Never put a credential, key or personal detail in the request; the endpoint refuses them.
  
  Command:
  
  ```bash
  curl -s https://jithox.com/api/agent-preflight/v1/evaluate \
    -H 'content-type: application/json' \
    -d '{"schemaVersion":"jithox.agent-action-preflight-request/v1","action":{"type":"send_message","target":{"kind":"email","id":"customer:EXAMPLE-1"},"summary":"Reply to the customer's question."},"agent":{"id":"my-agent","client":"claude"},"owner":{"ref":"owner:me"},"requestedPermissions":["read","draft_messages","send_external_messages"],"dataClassification":"internal","money":null,"externalSideEffect":true,"reversible":"no","authority":{"kind":"none"},"humanApproval":null,"idempotencyKey":"reply-customer-1-2026-09-10","requestedExpiresAt":"2026-09-10T14:00:00Z"}'
  ```

• Codex CLI CONFIG READY

  Add the rule to AGENTS.md at the repository root; Codex reads it at the start of every session and can run the curl in its sandbox.

  AGENTS.md

  # Agent Action Preflight (Jithox)
  
  Before any action that sends, publishes, buys, submits, accepts, tests or changes something outside the workspace:
  1. POST the planned action to https://jithox.com/api/agent-preflight/v1/evaluate (schema: https://jithox.com/api/agent-preflight/v1/schema).
  2. Act only on ALLOWED_TO_PREPARE. On HUMAN_APPROVAL_REQUIRED, show the owner the actionHash and stop. On BLOCKED or UNAVAILABLE, stop and report the reason codes.
  3. Never execute the external step yourself; Jithox does not execute either. Hand an approved hash to the official connector.
  4. Never put a credential, key or personal detail in the request; the endpoint refuses them.
  
  ```bash
  curl -s https://jithox.com/api/agent-preflight/v1/evaluate \
    -H 'content-type: application/json' \
    -d '{"schemaVersion":"jithox.agent-action-preflight-request/v1","action":{"type":"send_message","target":{"kind":"email","id":"customer:EXAMPLE-1"},"summary":"Reply to the customer's question."},"agent":{"id":"my-agent","client":"claude"},"owner":{"ref":"owner:me"},"requestedPermissions":["read","draft_messages","send_external_messages"],"dataClassification":"internal","money":null,"externalSideEffect":true,"reversible":"no","authority":{"kind":"none"},"humanApproval":null,"idempotencyKey":"reply-customer-1-2026-09-10","requestedExpiresAt":"2026-09-10T14:00:00Z"}'
  ```

• Gemini CLI CONFIG READY

  Add the rule to GEMINI.md in the project; Gemini CLI loads it as context and can execute the curl with its shell tool.

  GEMINI.md

  # Jithox Agent Action Preflight
  
  Before any action that sends, publishes, buys, submits, accepts, tests or changes something outside the workspace:
  1. POST the planned action to https://jithox.com/api/agent-preflight/v1/evaluate (schema: https://jithox.com/api/agent-preflight/v1/schema).
  2. Act only on ALLOWED_TO_PREPARE. On HUMAN_APPROVAL_REQUIRED, show the owner the actionHash and stop. On BLOCKED or UNAVAILABLE, stop and report the reason codes.
  3. Never execute the external step yourself; Jithox does not execute either. Hand an approved hash to the official connector.
  4. Never put a credential, key or personal detail in the request; the endpoint refuses them.
  
  ```bash
  curl -s https://jithox.com/api/agent-preflight/v1/evaluate \
    -H 'content-type: application/json' \
    -d '{"schemaVersion":"jithox.agent-action-preflight-request/v1","action":{"type":"send_message","target":{"kind":"email","id":"customer:EXAMPLE-1"},"summary":"Reply to the customer's question."},"agent":{"id":"my-agent","client":"claude"},"owner":{"ref":"owner:me"},"requestedPermissions":["read","draft_messages","send_external_messages"],"dataClassification":"internal","money":null,"externalSideEffect":true,"reversible":"no","authority":{"kind":"none"},"humanApproval":null,"idempotencyKey":"reply-customer-1-2026-09-10","requestedExpiresAt":"2026-09-10T14:00:00Z"}'
  ```

• Cursor / Grok CONFIG READY

  Save the rule as a Cursor rule file so every agent session in the project applies it; a Grok-based client that reads project rules uses the same file.

  .cursor/rules/jithox-agent-preflight.mdc

  ---
  description: Check every external action with Jithox Agent Action Preflight before acting
  alwaysApply: true
  ---
  
  Before any action that sends, publishes, buys, submits, accepts, tests or changes something outside the workspace:
  1. POST the planned action to https://jithox.com/api/agent-preflight/v1/evaluate (schema: https://jithox.com/api/agent-preflight/v1/schema).
  2. Act only on ALLOWED_TO_PREPARE. On HUMAN_APPROVAL_REQUIRED, show the owner the actionHash and stop. On BLOCKED or UNAVAILABLE, stop and report the reason codes.
  3. Never execute the external step yourself; Jithox does not execute either. Hand an approved hash to the official connector.
  4. Never put a credential, key or personal detail in the request; the endpoint refuses them.
  
  ```bash
  curl -s https://jithox.com/api/agent-preflight/v1/evaluate \
    -H 'content-type: application/json' \
    -d '{"schemaVersion":"jithox.agent-action-preflight-request/v1","action":{"type":"send_message","target":{"kind":"email","id":"customer:EXAMPLE-1"},"summary":"Reply to the customer's question."},"agent":{"id":"my-agent","client":"claude"},"owner":{"ref":"owner:me"},"requestedPermissions":["read","draft_messages","send_external_messages"],"dataClassification":"internal","money":null,"externalSideEffect":true,"reversible":"no","authority":{"kind":"none"},"humanApproval":null,"idempotencyKey":"reply-customer-1-2026-09-10","requestedExpiresAt":"2026-09-10T14:00:00Z"}'
  ```

• Any HTTP or CLI agent CONFIG READY

  One JSON request, one JSON answer. No key in this build; the response is no-store and carries the decision, the reason codes and the hash-bound receipt.

  curl

  curl -s https://jithox.com/api/agent-preflight/v1/evaluate \
    -H 'content-type: application/json' \
    -d '{"schemaVersion":"jithox.agent-action-preflight-request/v1","action":{"type":"send_message","target":{"kind":"email","id":"customer:EXAMPLE-1"},"summary":"Reply to the customer's question."},"agent":{"id":"my-agent","client":"claude"},"owner":{"ref":"owner:me"},"requestedPermissions":["read","draft_messages","send_external_messages"],"dataClassification":"internal","money":null,"externalSideEffect":true,"reversible":"no","authority":{"kind":"none"},"humanApproval":null,"idempotencyKey":"reply-customer-1-2026-09-10","requestedExpiresAt":"2026-09-10T14:00:00Z"}'

• MCP tool (fleet handoff) NOT CERTIFIED

  The MCP fleet lives in another repository owned by another team. The exact tool contract (name, input schema, output schema, decisions) is published in this build's schema document and in docs/handoffs/AGENT_ACTION_PREFLIGHT_MCP_HANDOFF.md, so the fleet can add the tool without inventing anything.

  MCP tool contract

  {
    "name": "evaluate_action_preflight",
    "inputSchema": "https://jithox.com/api/agent-preflight/v1/schema#/request",
    "outputSchema": "https://jithox.com/api/agent-preflight/v1/schema#/result",
    "decisions": [
      "ALLOWED_TO_PREPARE",
      "HUMAN_APPROVAL_REQUIRED",
      "BLOCKED",
      "UNAVAILABLE"
    ],
    "executes": false
  }

Also on the developer hub; in Team Builder (Labs) a plan can require every external action to pass this preflight first.