Evaluate: the one call

Whatever built your agent, this is the integration surface. One call, one verb back.

POST /v1/workspaces/:ws/evaluate
Authorization: Bearer mnx_ask_...

{
  "action": "payment.refund",
  "resource": { "type": "customer", "id": "c_481" },
  "principal": "sarah@acme.test",
  "amount": 4500,
  "reason": "duplicate charge reported in ticket 8812",
  "reads": ["evt_9f21"]
}

{
  "decision": "escalate",
  "reason": "no rule forbids this, but payment.refund of 4500 is somebody's to authorize: the Finance Manager approves refunds up to 5000",
  "approvers": [
    {
      "id": "manager@acme.test",
      "because": "the Finance Manager approves refunds up to 5000",
      "limit": 5000
    }
  ],
  "policies": ["fact_7c1e"],
  "context": [{ "id": "evt_9f21", "content": "..." }],
  "constraints": ["never refund without a ticket"],
  "missingContext": [],
  "withheld": 0
}

The caller never has to model the organization to use this. An agent platform, a one-file script and a bought-in AI worker all integrate the same way.

The six answers

Three layers, and none speaks for another

1. 1

   The runtime decides whether a rule forbids it

   Deterministic, with no model in the path. Its refusal is final and nothing above widens it.

2. 2

   The organization decides who could authorize it

   From verified authority facts, at the size the action actually is. Only verified facts count; a candidate authorizes nothing.

3. 3

   The clearance decides how much of the answer you are told

   Filtered to what this grant, narrowed to its principal, is entitled to know.

This is why an action can be allowed by every rule and still come back as an escalation. No policy file knows that refunds above five thousand are the Finance Manager's to authorize. The organization does.

The fields that carry weight

The open-source client

npm install @memnox/organization

import { MemnoxOrganization, mayProceed } from "@memnox/organization";
 
const memnox = new MemnoxOrganization({
  token: process.env.MEMNOX_GRANT,
  workspace: "acme",
});
 
const answer = await memnox.evaluate({
  action: "payment.refund",
  resource: { type: "customer", id: "c_481" },
  principal: "sarah@acme.test",
  amount: 4500,
  reads: factIds,
});
 
if (mayProceed(answer)) {
  await stripe.refunds.create({ /* ... */ });
}

Apache-2.0, and deliberately thin. It is the protocol and nothing else: no tools, no execution, no copy of the organization. It never fails open, so a call that cannot reach Memnox throws rather than returning a permissive default.

Three ways in

Which one you use depends on what you already have, not on what Memnox prefers.

1. 1

   HTTP or the SDK

   For an agent that already knows how to reach its tools. Send identity, intent and resource; act on the verb. Nothing else changes.

2. 2

   MCP

   For an AI-native agent. Point it at POST /v1/workspaces/:ws/mcp and it gains the tools below without anybody writing an integration.

3. 3

   Ask grants per agent

   Every agent gets its own credential, with its own ceiling, its own principal and its own stated restrictions. Revoking one takes effect on that agent's next question.

Memnox does not need your agent's connectors. It needs to know who is asking, who they represent, what they intend and what they are relying on.

The tools an agent sees over MCP

Precedent is the one of these that reads the organization's own behaviour rather than its statements. A decision is what the company wrote down; this is what kept happening. Three escalations to the same person is a rule nobody got round to writing, and an agent that can see it stops re-litigating a settled question. It reports the verb, who it went to, and the reason each asker gave, never what any of those answers contained.

The client, in full

npm install @memnox/organization

Nothing there writes, and it never fails open: a call that cannot reach Memnox throws rather than returning a permissive default.

Every one of them is a read. There is no tool that writes: an MCP server that could change the organization would be an agent, and Memnox governs agents rather than being one.

Everything is recorded before the runtime sees it

Each question and each routing appends to the ledger with the agent, its principal, what was asked, and how much was withheld. The question is kept in the agent's own words; the answer is only counted, because a ledger that quoted answers would be a second copy of everything sensitive a reader was allowed to see.

When somebody has to take it

An escalation or a delegation opens a handoff: the work waits for the person it names, and they are told. It is deliberately not an approval. An approval asks whether an action may proceed and the runtime owns that; a handoff asks whether somebody will take it. An approval that lapses blocks an action, a handoff that lapses is a person who never picked something up, and counting them together would hide the second behind the first.

Only somebody it was offered to may answer, and only once.

See Organizational state for where the authority behind an escalation comes from, and Need to know for what decides how much of an answer an agent is given.