Documentation

Action Gateway

Verify checks whether an action is allowed. The Action Gateway enforces that decision by executing only supported allowed actions through BehalfID.

MVP scope

The current gateway supports one safe executor: public web reads. It accepts a URL and returns the page content only when the corresponding browse_web permission is allowed.

Usage

execute.ts

const result = await behalf.executeAction({
  agentId: "agent_xxx",
  action: "browse_web",
  resource: "example.com",
  params: { url: "https://example.com/page" },
});

// result.output contains the page content when allowed
// result.allowed === false when denied

REST endpoint

POST /api/actions/execute

{
  "agentId": "agent_xxx",
  "action": "browse_web",
  "resource": "example.com",
  "params": {
    "url": "https://example.com/page"
  }
}