Runtime control hooks for AI agent harnesses

An admission-control boundary for agent operations

Before a tool call executes, the harness emits a canonical tool.beforeevent through hooks/intercept. Each configured backend returns either no effect or one explicit deny. The harness stays the execution and security boundary: it enforces deadlines, failure policy, and its own permissions.

Agent requests a tool call
            │
            ▼
Harness creates a canonical tool.before event
            │
            ▼
Configured AHP backends evaluate it in order
            │
            ├── deny ──▶ Harness stops the tool call
            │
            └── no effect from every backend
                         │
                         ▼
Harness applies its own permissions and sandbox
            │
            ▼
Tool executes

Plain JSON-RPC on the wire

AHP uses UTF-8 JSON-RPC 2.0 over newline-delimited stdio or bounded HTTP POST. Every request is self-describing: it carries the protocol version and the exact effects the harness can enforce, so backends never infer behavior from a vendor name.

{
  "jsonrpc": "2.0",
  "id": "evt_01JQ8Z2Y6YR0H8N7Q2M3X4V5W6",
  "method": "hooks/intercept",
  "params": {
    "protocolVersion": "0.1",
    "event": {
      "type": "tool.before",
      "session": { "id": "sess_123" },
      "tool": {
        "callId": "call_456",
        "name": "Bash",
        "kind": "shell",
        "input": { "command": "git push --force" }
      }
    },
    "capabilities": { "effects": ["deny"] }
  }
}

Explore the documentation

Informative guides to the Working Draft, organized by protocol concern.

Where AHP fits

AHP complements existing agent standards; it does not replace tool connectivity, client–agent communication, agent collaboration, or observability.

Status: Working Draft