# Agent Profile Standard v1

## Purpose

One shared Agent Runtime serves both single-app and multi-app assistants. An
Agent Profile is versioned tenant policy, not a fork of runtime code.

Each profile declares:

- stable `agent_key`, display name, profile and instruction versions;
- allowed capability identifiers;
- optional WordPress roles;
- confirmation policy by risk category;
- maximum steps and optional monthly token budget;
- status and customer-safe description.

## Effective tools

A declared capability is not automatically executable. The effective catalog
is the intersection of:

```text
published agent tools
∩ active tenant subscription
∩ enabled apps
∩ profile capabilities
∩ authenticated user roles
∩ runtime policy and quotas
```

Profiles may safely reference future capabilities. They appear only after the
app is enabled and publishes a valid agent tool contract. A profile can make a
tool confirmation policy stricter, never weaker.

## Reference profiles

`abn_assistant` is a single-app profile with one read capability and one step.
`operations_assistant` is a multi-app profile that currently sees only ABN
Lookup. Invoice and AroFlo capabilities will become effective progressively as
those apps migrate to the platform standard.

## Security

The client submits `agent_key`, never an arbitrary capability allowlist. Flask
loads the profile for the authenticated tenant and roles, filters the catalog,
and returns the selected profile version with every resolution. The Bridge
checks that the returned profile matches the submitted profile before it invokes
the app gateway.

Profile instructions are data and cannot override tenant isolation, app
entitlements, JSON Schema, risk classification, confirmation, idempotency,
quota, or target-app domain validation.

## Future multi-step execution

`max_steps` is enforced as a declared ceiling for the future planner. Phase 1
still executes one tool per request. Multi-step orchestration must add durable
run state, per-step request IDs, loop detection, total token/tool budgets,
approval suspension, resumability, and a composed response envelope before it
can execute more than one capability.