A small, machine-readable policy that bounds what AI agents may do in a workspace — enforced in-function before any tool call runs, with violations recorded to the tamper-evident audit log. This is the schema that's actually enforced today, published openly so other tools can read, write, and adopt it.
The Constitution is a JSON/YAML object attached to a workspace (and, optionally, narrowed per agent key). Before an agent action executes, the gateway evaluates the action against the Constitution. A violation is denied (HTTP 403) and audited; a low-confidence action may be routed to a human approval queue instead of executing. The policy is intentionally small and bounded — every field is enforceable, not advisory.
| field | type | semantics |
|---|---|---|
| max_priority | enum: low·medium·high·critical | Agents may not create or raise a task above this priority. |
| forbidden_terms | string[] | Action is denied if the task title/body contains any of these (case-insensitive). |
| forbidden_assignees | string[] | Agents may not assign work to these people/roles (e.g. CEO). |
| forbidden_tags | string[] | Agents may not apply these tags. |
| quiet_hours_utc | { start:int, end:int } | Hours (0–23, UTC) during which agent writes are blocked. |
| max_creates_per_day | integer ≥ 0 | Per-agent daily cap on task creation. |
| require_approval_below_confidence | number 0–1 | Actions whose AI confidence is below this threshold route to the human approval queue instead of executing. |
403 with { error, code: "constitution.<rule>" } and writes a denied:constitution row to the audit log.require_approval_below_confidence is staged to the human approval queue (HTTP 202) and executes only on approval.An implementation is v0.1-conformant if it (a) accepts a policy matching the schema above, (b) rejects unknown fields on write, (c) enforces each present field with the stated semantics, and (d) audits denials and approvals. Versions are MAJOR.MINOR; new optional fields bump MINOR (back-compatible), removing/changing a field bumps MAJOR. This is v0.1, Draft — open for comment at agents@flowdesk.app. The intent is a small, shared, enforceable vocabulary for agent policy — adopt it, extend it, tell us where it's wrong.