Action catalog and custom actions

Agents do far more than refunds. Any business action can go through Action Control: the built-in ones Audon’s connectors execute, actions from the catalog, and your own. Identity, allowed actions, your policies, limits and budgets, duplicates and idempotency, approvals, the kill switch and evidence work the same for all of them; built-in business rules (refundable balance, already cancelled …) exist only for the built-in actions.

Three kinds of action

• Built in: refund.create, credit.create, discount.create, subscription.cancel, subscription.update, order.cancel. Executed and verified by Stripe, Shopify, a Webhook or the Test connector.
• From the catalog: added to your organization with one click and then yours to change.
• Custom: your own id, fields and risk.

How your own actions run

• Webhook: your endpoint executes it, under the Webhook connector contract (signed request, Idempotency-Key, a status endpoint for reconciliation). The request carries type (your action id), count and params.
• Decision only: Audon decides (allow, deny, approval) and records the evidence; the agent executes it and reports the outcome (report_outcome).

Fields

A type says what the controls can see: an amount (money, in minor units, optionally a fixed currency), a count (recipients, rows, seats), what the resource is, and typed attributes your policies test as params.<key>. Changing fields, execution, connector, risk or category creates a new version; every action records the version it ran under.

{
  "id": "loyalty.points.grant",
  "name": "Grant loyalty points",
  "category": "commerce",
  "risk": "medium",
  "execution": "webhook",
  "connector_id": "icn_…",
  "fields": {
    "count": {
      "enabled": true,
      "label": "points"
    },
    "resource": {
      "label": "Customer id"
    },
    "attributes": [
      {
        "key": "tier",
        "type": "enum",
        "label": "Tier",
        "values": [
          "gold",
          "silver"
        ],
        "required": true
      }
    ]
  }
}

Policies for any action

Rules can match categories, risk and count, and the quantity limit sums counts over a window:

{
  "rules": [
    {
      "id": "bulk-sends",
      "effect": "require_approval",
      "match": {
        "categories": [
          "communication"
        ],
        "count": {
          "gt": 100
        }
      }
    },
    {
      "id": "no-critical",
      "effect": "deny",
      "match": {
        "risk": [
          "critical"
        ]
      }
    },
    {
      "id": "sms-per-day",
      "effect": "limit",
      "match": {
        "action_types": [
          "sms.send"
        ]
      },
      "limit": {
        "kind": "quantity",
        "max_quantity": 1000,
        "window_minutes": 1440,
        "per": "agent",
        "on_exceed": "require_approval"
      }
    }
  ]
}

The catalog

119 actions in 20 categories, each with a suggested default policy (added as a draft with with_policy; nothing applies until a person activates it).

API: integrity_action_catalog_list, integrity_action_types_add_template, integrity_action_type_create, integrity_action_type_update, integrity_action_type_archive (restore is human-only).