Tool-risk middleware driven by a decision model.
Base middleware class for an agent.
Subclass this and implement any of the defined methods to customize agent behavior between steps in the main agent loop.
State schema for the agent.
Allow low-risk tool calls and block risky calls using a decision model.
The middleware intercepts explicitly configured tools immediately before execution
and asks a Noul question for the probability that each call is risky or
insufficiently authorized. Calls below 0.5 execute normally. Calls at or above it
return an error ToolMessage without invoking the tool handler. Tool names not
listed in tools bypass classification.
The classifier receives the proposed tool call, the tool description, and up to 30 recent messages. Classification failures propagate and the tool handler is not called. This middleware blocks calls; it does not request human approval.
This middleware is in beta. Its API may change without notice.
