Define Action Sensitivity Levels in Config Object

Your agents execute tasks on your agent runtime. Without defined sensitivity levels, every action risks reaching production without review. The Agent Command Center solves this by letting you define action sensitivity levels config object so that only low-risk steps proceed automatically.

Key takeaways:

Sensitivity levels live inside the single versioned config object.
Every action that touches the real world must pass the approvals inbox.
Thresholds control token usage, tool calls, and schedule limits.
Changes to rules remain traceable across all runs.

Why Sensitivity Levels Matter for Every Agent You Run

Action sensitivity determines whether an output lands in the approvals inbox or executes immediately. Low-sensitivity tasks such as log queries can run without interruption. High-sensitivity tasks such as database writes or external API calls require explicit human approval.

Without these rules, teams lose visibility into token usage and cost estimates. The single config object keeps every threshold in one place so you can audit changes before the next execution. Teams that skip this step often discover after the fact that an agent performed an unapproved write or exceeded daily token budgets by several thousand tokens.

Consider a typical workflow where an agent handles both internal status checks and customer data updates. The first type stays low risk while the second always requires review. Defining levels upfront prevents accidental execution of the latter.

How to Define Sensitivity Levels in the Single Config Object

Open the config object for the target agent. Add a sensitivity section that lists each action type and its assigned level.

Create three default levels: low, medium, and high.
Assign low to read-only queries and status checks.
Assign medium to internal tool calls that do not alter state.
Assign high to any step that writes data or contacts external systems.

Update the object, then version the change. The Agent Command Center applies the new rules on the next scheduled run. You can also add custom fields such as required reviewer roles or escalation timeouts that apply only to high-level actions.

Setting Thresholds That Trigger the Approvals Inbox

Sensitivity levels feed directly into approval rules. Define numeric thresholds for each level so the runtime knows when to pause.

Token usage above 8000 on any step moves the action to medium.
Any tool call outside the approved list moves the action to high.
Scheduled tasks that exceed daily limits move the action to high.

These thresholds sit inside the same config object so you can review them alongside role prompts and model parameters. Adjust the numbers after reviewing the first few weeks of live visibility data from actual runs.

Mapping Sensitivity Rules to Specific Agent Actions

List every tool and endpoint your agents may call. Then map each one to a sensitivity level.

Internal database reads receive low sensitivity.
Cached vector searches receive low sensitivity.
Customer record updates receive high sensitivity.
Payment processing endpoints receive high sensitivity.
Email dispatch actions receive medium sensitivity.

Store the mapping in the config object. The approvals inbox then displays the exact rule that routed each entry. Revisit the list quarterly because new tools are often added to agent runtimes over time.

Aligning Sensitivity Levels with Established Security Guidelines

Sensitivity definitions should reference recognized security practices rather than remain purely internal. Map each level to controls described in external frameworks so auditors can trace decisions back to accepted standards.

Low-level actions align with routine monitoring permissions that require no extra sign-off.
Medium-level actions correspond to internal change controls that still allow optional review.
High-level actions match requirements for privileged operations that demand explicit human approval before execution.

Review the NIST AI Risk Management Framework guidelines when you first build the mapping. The same section of the config object can also reference controls from the OWASP LLM Top 10 project to address prompt injection or data leakage risks that often accompany high-sensitivity tool calls. This approach keeps your rules defensible during compliance reviews while preserving the single versioned object as the source of truth.

Comparing Sensitivity Levels Across Common Use Cases

Level	Example Actions	Required Approval	Token Limit	Schedule Restriction
Low	Status queries, cache reads	None	4000	None
Medium	Internal API calls, log exports	Optional review	8000	Daily cap
High	Data writes, external payments	Mandatory human sign-off	12000	Time-window only

Use this table when you review the config object with your team. Adjust numbers to match observed token usage from prior runs. Document any deviations in the version notes so future maintainers understand the rationale.

Monitoring Execution Logs and Cost Estimates

After you define the levels, watch live visibility streams for each run. The Agent Command Center shows intermediate outputs, token counts, and the sensitivity level applied to every step.

Review logs to confirm high-sensitivity actions reached the approvals inbox.
Compare cost estimates against your budget thresholds.
Export execution logs for compliance audits when needed.

Inspect agent state changes in execution history logs to trace which config version produced each decision. Track how often medium-level actions are escalated to high after token counts are recalculated mid-execution.

Versioning Changes to Sensitivity Rules

Every edit to the config object creates a new version. Keep a short changelog inside the object so future runs remain traceable.

Record the date and author of each threshold change.
Note which actions moved from medium to high.
Test the updated object on a staging agent before promoting it.

Implement retry logic in versioned agent config shows how to combine sensitivity rules with fallback behavior inside the same object. Maintain at least three prior versions so you can roll back if a new threshold unexpectedly blocks legitimate work.

Testing Sensitivity Gates on Your Agent Runtime

Run a controlled test with sample actions at each level. Confirm that high-sensitivity steps stop at the approvals inbox and that low-sensitivity steps complete without intervention.

Execute ten low-sensitivity queries and verify zero inbox entries.
Execute five high-sensitivity writes and verify all five require approval.
Check that token usage and cost estimates appear in the inbox record.

Audit cost estimates in approvals inbox before actions explains how to add cost gates that complement sensitivity levels. Run the test suite after every major config version bump.

Next Steps

Review your current config object and add the sensitivity section today. Start with the three default levels, then adjust thresholds after you inspect the first week of execution logs. Human approval remains required for every action that touches the real world.

Map at least five tools to levels this week.
Set initial token thresholds based on observed averages.
Schedule a quarterly review of the version history.
Export sample logs to verify audit trail completeness.
Compare results against the security framework references you adopted.

Frequently Asked Questions

How many sensitivity levels should I start with?

Begin with the three levels shown in the comparison table. Add custom levels only after you have measured token usage across multiple runs.

Can I change sensitivity rules without restarting agents?

Yes. Update the single config object, create a new version, and the next scheduled execution uses the updated rules.

Do sensitivity levels affect model parameters?

They do not change temperature or top-p settings. Those remain separate fields inside the same config object.

What happens if an action exceeds its token limit?

The runtime routes the step to the approvals inbox regardless of the base sensitivity level assigned to the tool.

How do I share sensitivity settings across multiple agents?

Reference a shared config fragment from each agent object. Changes to the fragment propagate to every agent that imports it.