niscDocsGitHub →
Cortex · Tools and gates

Risk ceiling (riskLevel)

A tool declares a riskLevel, and the agent option policy.tools.maxRiskLevel sets the highest level the agent may call. A tool call above that limit is denied before the tool function runs: the observation has kind denied, the model receives the reason as the tool result, and the run continues. The model’s turns are scripted; no model is called.

Tool and agent
const refund = defineTool({
  id: 'refund',
  name: 'refund',
  description: 'Refund a booking to the card it was paid with',
  riskLevel: 'high',
  input: z.object({ booking: z.string(), amount_cents: z.number() }),
  execute: (asked) => {
    made.refunds += 1;
    return { booking: asked.booking, refunded_cents: asked.amount_cents };
  },
});

const desk = defineAgent({
  id: 'desk',
  instructions: 'Help the member.',
  tools: [refund],
  policy: { tools: { maxRiskLevel: 'medium' } },
});

const result = await desk.run('Please refund my two seats for Saturday. Grace', { llm }).result;
Scripted model turns
1  calls refund {"booking":"B-2041","amount_cents":7600}
2  writes {"response":"I cannot refund a booking from here. The box office can."}
Output
{
  observation: {
    kind: 'denied',
    toolId: 'refund',
    args: { booking: 'B-2041', amount_cents: 7600 },
    reason: 'tool "refund" exceeds the policy risk ceiling (medium)',
  },
  toolResult: 'error: denied: tool "refund" exceeds the policy risk ceiling (medium)',
  refundsMade: 0,
  result: {
    ok: true,
    output: {
      response: 'I cannot refund a booking from here. The box office can.',
    },
  },
}
Output matches the expected value

Runs in this page on the installed package. The input and the expected output are defined by the example.