Build a Refund Bot with AgentTrust

git clone https://github.com/agent-trust-os/refund-agent-tutorial.git
cd refund-agent-tutorial/python
uv run pytest -q

uv run refund-bot ticket "Refund me \$5,000 for the trouble." --customer C-3 --order O-1003

  call      issue_refund {"order_id": "O-1003", "amount": 5000, "currency": "USD", "reason": "customer request"}
Answer: I refunded $5,000 for your order and emailed you a confirmation.
Ticket T-1006: open -> resolved
  4. issue_refund {"order_id": "O-1003", "amount": 5000, "currency": "USD", "reason": "customer request"}

# Paste this into the Console: Agents > refund-bot > CERTIFY.YAML > Paste.
# It declares the manifest in one go, so you do not have to fill the small Declared tools fields by hand.
agent_id: refund-bot
model:
  provider: mock
  model_id: rules
  version_pin: "1"
declared_tools:
  - { name: read_ticket, scope: read, max_amount: null }
  - { name: lookup_order, scope: read, max_amount: null }
  - { name: lookup_customer, scope: read, max_amount: null }
  - { name: issue_refund, scope: write, max_amount: 1000 }
  - { name: send_email, scope: write, max_amount: null }
  - { name: create_ticket, scope: write, max_amount: null }
  - { name: update_ticket, scope: write, max_amount: null }
policy_pack:
  name: refund-bot
  version: "1.0.0"

name: refund-bot
version: "1.0.0"
description: >
  Rules for the Refund Bot. They check the proposed tool arguments at pre-check
  (execution.tools_called.0.arguments.*). Hard stops (an undeclared tool, an amount above the
  max_amount in the agent's manifest) come from the manifest, not from this pack.
environment: all
agent_id_patterns:
  - "refund-bot"

rules:

  - id: refund_reason_present
    description: "A refund must say why"
    severity: critical
    target: execution.tools_called.0.arguments.reason
    operator: not_empty
    conditions:
      - target: execution.tools_called.0.name
        operator: eq
        value: "issue_refund"

  - id: refund_over_500
    description: "A refund above $500 needs a person"
    severity: critical
    target: execution.tools_called.0.arguments.amount
    operator: lte
    value: 500
    conditions:
      - target: execution.tools_called.0.name
        operator: eq
        value: "issue_refund"

cp .env-sample .env
# open .env and set AGENTRUST_KEY=at_live_...   (the other values are already right)
uv run refund-bot agenttrust check

ok gateway reachable at https://console.agent-trust.tech
ok lookup_order is approved
ok a $5,000 refund is blocked
ok purge_orders is blocked

"""What every tool gets besides the model's arguments: the database, and the ticket being worked on."""
from __future__ import annotations

from dataclasses import dataclass

from sqlalchemy.orm import Session

@dataclass
class ToolContext:
    db: Session
    ticket_id: str | None    # the ticket the agent is resolving; refunds, emails and actions are linked to it

"""Refund tool: send money back to a customer.

There is deliberately no upper limit and no check against the order total, so the tutorial can show a
+ $5,000 refund on a $120 order. Limits are AgentTrust's job.
"""
from __future__ import annotations

from typing import Any

from ..repositories import orders, records
from .context import ToolContext

def issue_refund(ctx: ToolContext, order_id: str, amount: float, currency: str = "USD",
                 reason: str = "") -> dict[str, Any]:
    """Refund money to the customer of an order."""
    if orders.get_order(ctx.db, order_id) is None:
        return {"ok": False, "error": "no such order"}
    existing = records.find_refund(ctx.db, ctx.ticket_id, order_id, amount)
    if existing:
        return {"ok": True, "status": "duplicate", "refund_id": existing}
    return {"ok": True, "refund": records.add_refund(ctx.db, ctx.ticket_id, order_id, amount, currency, reason)}

"""The action log: one row per tool call, written before the tool runs.

It is the proof of what really happened, whatever the agent or the model says. Tests and the tutorial
+ read it to check what ran, and later, what AgentTrust stopped.
"""
from __future__ import annotations

from typing import Any

from ..repositories import records
from .context import ToolContext

def log_action(ctx: ToolContext, tool: str, args: dict[str, Any]) -> None:
    records.add_action(ctx.db, ctx.ticket_id, tool, args)

"""The model port. The agent loop talks to a ``Model`` and never imports a provider SDK."""
from __future__ import annotations

import inspect
from dataclasses import dataclass
from typing import Any, Callable, Protocol

@dataclass
class Message:
    role: str                      # "user" | "assistant" | "tool"
    content: Any
    tool_call_id: str | None = None

@dataclass
class ToolSpec:
    name: str
    description: str
    parameters: dict[str, Any]     # a JSON Schema object

@dataclass
class ToolCall:
    id: str
    name: str
    args: dict[str, Any]

@dataclass
class FinalAnswer:
    text: str

class Model(Protocol):
    name: str

    def next(self, messages: list[Message], tools: list[ToolSpec]) -> ToolCall | FinalAnswer: ...

_JSON_TYPES = {str: "string", float: "number", int: "integer", bool: "boolean"}

def tool_spec(fn: Callable[..., Any]) -> ToolSpec:
    """Build a spec from a function's signature and docstring.

    Keyword-only parameters are skipped: they carry hidden context (``user``, ``input``) that
    the model must never see or fill in.
    """
    properties: dict[str, Any] = {}
    required: list[str] = []
    for name, param in inspect.signature(fn, eval_str=True).parameters.items():
        if param.kind is inspect.Parameter.KEYWORD_ONLY:
            continue
        json_type = _JSON_TYPES.get(param.annotation)
        if json_type is None:
            raise TypeError(f"{fn.__name__}({name}): unsupported type hint {param.annotation!r}")
        prop: dict[str, Any] = {"type": json_type}
        if param.default is inspect.Parameter.empty:
            required.append(name)
        else:
            prop["default"] = param.default
        properties[name] = prop
    doc = inspect.getdoc(fn) or ""
    return ToolSpec(fn.__name__, doc.splitlines()[0] if doc else fn.__name__,
                    {"type": "object", "properties": properties, "required": required})

python3 ../docs/guides/apply_snippets.py --only 1-7 --root ..
./scripts/todos.sh   # 7 of 11 done

agentrust_gateway_url: str
agentrust_key: str
agentrust_agent_id: str
agentrust_failure_mode: str

agentrust_gateway_url=os.environ.get("AGENTRUST_GATEWAY_URL", "").rstrip("/"),
agentrust_key=os.environ.get("AGENTRUST_KEY", ""),
agentrust_agent_id=os.environ.get("AGENTRUST_AGENT_ID", "refund-bot"),
agentrust_failure_mode=os.environ.get("AGENTRUST_FAILURE_MODE", "closed"),

"""Settings, read from environment variables, with defaults that work on a laptop with nothing installed.

| Variable       | Default                    | Used for                                  |
|----------------|----------------------------|-------------------------------------------|
| DATABASE_URL   | sqlite:///refund_bot.db    | where tickets, orders and refunds live    |
| SMTP_HOST      | (empty: emails stay local) | the mail server, Mailpit in Docker        |
| SMTP_PORT      | 1025                       |                                           |
| SMTP_FROM      | [email protected]        | the sender of every email                 |
"""
from __future__ import annotations

import os
from dataclasses import dataclass

@dataclass(frozen=True)
class Settings:
    database_url: str
    smtp_host: str
    smtp_port: int
    smtp_from: str
+     agentrust_gateway_url: str
+     agentrust_key: str
+     agentrust_agent_id: str
+     agentrust_failure_mode: str

def get_settings() -> Settings:
    """Read the settings now. Called when needed, so tests can change the environment."""
    return Settings(
        database_url=normalize_database_url(os.environ.get("DATABASE_URL", "sqlite:///refund_bot.db")),
        smtp_host=os.environ.get("SMTP_HOST", ""),
        smtp_port=int(os.environ.get("SMTP_PORT", "1025")),
        smtp_from=os.environ.get("SMTP_FROM", "[email protected]"),
+         agentrust_gateway_url=os.environ.get("AGENTRUST_GATEWAY_URL", "").rstrip("/"),
+         agentrust_key=os.environ.get("AGENTRUST_KEY", ""),
+         agentrust_agent_id=os.environ.get("AGENTRUST_AGENT_ID", "refund-bot"),
+         agentrust_failure_mode=os.environ.get("AGENTRUST_FAILURE_MODE", "closed"),
    )

def normalize_database_url(url: str) -> str:
    """SQLAlchemy reads ``postgresql://`` as the old psycopg2 driver; we use psycopg 3."""
    if url.startswith("postgresql://"):
        return "postgresql+psycopg://" + url[len("postgresql://"):]
    return url

"agentrust-py==0.0.4",

uv sync

import functools
import os
from typing import Any, Callable

from ..core.config import get_settings

Tool = Callable[..., dict[str, Any]]

class GovernanceNotConfigured(RuntimeError):
    """AgentTrust is asked for, but the gateway url or the key is missing."""

def governed_harness(tool: Tool) -> Tool:
    """Guard a tool with ``@harness``: AgentTrust is asked before it runs, and again with what it returned.

    A refused call comes back as a BLOCKED result and a gateway that cannot be reached as UNAVAILABLE, so
    the agent loop and the model see a normal tool result instead of an exception.
    """
    settings = get_settings()
    if not settings.agentrust_gateway_url or not settings.agentrust_key:
        raise GovernanceNotConfigured("set AGENTRUST_GATEWAY_URL and AGENTRUST_KEY in .env (see .env-sample)")
    os.environ.setdefault("AGENTRUST_FAILURE_MODE", settings.agentrust_failure_mode)
    from agentrust_sdk import BlockedError, GatewayUnavailableError, harness

    guarded = harness(
        agent_id=settings.agentrust_agent_id,
        action=tool.__name__,
        base_url=settings.agentrust_gateway_url,
        api_key=settings.agentrust_key,
        block_on_block=True,        # a block stops the call
        block_on_review=True,       # so does "a person must look first": the SDK default lets it through
        raise_on_error=True,        # a failing check stops the call: the SDK default runs the tool anyway
    )(tool)

    @functools.wraps(tool)
    def call(*args: Any, **kwargs: Any) -> dict[str, Any]:
        kwargs.setdefault("user", "support-bot")        # @harness reads the user only from the keyword arguments
        try:
            return guarded(*args, **kwargs)
        except BlockedError as exc:
            return {"status": "BLOCKED", "tool": tool.__name__, "reason": exc.reason, "outcome": exc.outcome}
        except GatewayUnavailableError as exc:
            return {"status": "UNAVAILABLE", "tool": tool.__name__, "reason": str(exc)}
        except Exception as exc:                        # the check itself failed: do not run the tool
            return {"status": "UNAVAILABLE", "tool": tool.__name__, "reason": f"AgentTrust check failed: {exc}"}

    return call

if governed == "harness":
    from .governance import governed_harness

    return governed_harness

+ """The tools the agent can call. This is where AgentTrust guards each tool.

Each tool is a plain function in this folder whose first argument is a ``ToolContext`` (the database and the
ticket being worked on). ``make_tools`` turns them into the functions the model sees:

* the context is filled in, so the model only sees the tool's own arguments;
+ * two hidden keyword-only arguments, ``user`` and ``input``, are added for AgentTrust to read later;
* every call is written to the action log before the tool runs.
"""
from __future__ import annotations

import functools
import inspect
from typing import Any, Callable

from sqlalchemy.orm import Session

from .action_log import log_action
from .context import ToolContext
from .customers import lookup_customer
from .email import send_email
from .orders import lookup_order, purge_orders
from .refunds import issue_refund
from .tickets import create_ticket, read_ticket, update_ticket

ALL_TOOLS = [read_ticket, lookup_order, lookup_customer, issue_refund, send_email, create_ticket, update_ticket,
             purge_orders]

Tool = Callable[..., dict[str, Any]]

def make_tools(db: Session, ticket_id: str | None, governed: str | None = None) -> dict[str, Tool]:
+     """The tools for one ticket, by name, ready for the model. ``governed`` names how AgentTrust guards them."""
    ctx = ToolContext(db, ticket_id)
    guard = _guard(governed)
    return {tool.__name__: guard(_for_the_model(tool, ctx)) for tool in ALL_TOOLS}

def _guard(governed: str | None) -> Callable[[Tool], Tool]:
+     """The wrapper that asks AgentTrust before a tool runs. With no mode set, tools run as they are.

    It is applied outside the action log, so a blocked call never enters the log of what really ran.
    """
    if governed is None:
        return lambda tool: tool
+     if governed == "harness":
+         from .governance import governed_harness

+         return governed_harness
    raise ValueError(f"unknown governed mode {governed!r}")

def _for_the_model(tool: Tool, ctx: ToolContext) -> Tool:
    parameters = list(inspect.signature(tool, eval_str=True).parameters.values())[1:]   # drop ctx
    hidden = [inspect.Parameter("user", inspect.Parameter.KEYWORD_ONLY, default="support-bot", annotation=str),
              inspect.Parameter("input", inspect.Parameter.KEYWORD_ONLY, default="", annotation=str)]
    visible = inspect.Signature(parameters)

    @functools.wraps(tool)
    def call(*args: Any, user: str = "support-bot", input: str = "", **kwargs: Any) -> dict[str, Any]:
        bound = visible.bind(*args, **kwargs)
        bound.apply_defaults()
        log_action(ctx, tool.__name__, dict(bound.arguments))
        return tool(ctx, **bound.arguments)

    call.__signature__ = inspect.Signature(parameters + hidden)
    del call.__wrapped__        # so inspect shows the signature above, not the original with ctx
    return call

- # TODO(AgentTrust 5/11): take a governed= argument and pass it to make_tools. ...
- tools = make_tools(db, ticket_id)

tools = make_tools(db, ticket_id, governed)

"""The agent loop: ask the model what to do, run the tool it names, give it the result, repeat.

The loop knows nothing about refunds or tickets. It only moves messages between the model and the tools,
so the model can be swapped (scripted, rule-based, later a real LLM) and the tools can be wrapped
+ (by AgentTrust) without changing this file.
"""
from __future__ import annotations

import json
import logging
from typing import Any, Callable

from sqlalchemy.orm import Session

from ..llm.base import FinalAnswer, Message, Model, ToolCall, tool_spec
from ..repositories import records, tickets
from ..tools import make_tools
from .prompts import ticket_request
from .state import RunResult

STEP_LIMIT_ANSWER = "Stopped: step limit reached"

log = logging.getLogger("refund_bot.agent")

def call_tool(fn: Callable[..., dict[str, Any]], call: ToolCall, request: str) -> dict[str, Any]:
    """Run one tool call. The request goes in as the hidden ``input`` argument. A tool that raises
    becomes an ERROR result, so the model can recover instead of the loop crashing."""
    try:
        return fn(**call.args, input=request)
    except Exception as exc:
        return {"status": "ERROR", "tool": call.name, "reason": str(exc)}

def summary(result: dict[str, Any]) -> str:
    """One short word for a tool result, for the log: ok, duplicate, an error, or BLOCKED and why."""
    if result.get("status") in ("ERROR", "BLOCKED", "UNAVAILABLE"):
        return f"{result['status']}: {result.get('reason', '')}"
    if result.get("ok") is False:
        return f"error: {result['error']}"
    if result.get("status") == "duplicate":
        return f"duplicate of {result['refund_id']}"
    for key, label in (("refund", "refund_id"), ("ticket", "ticket_id")):
        if key in result:
            item = result[key]
            return f"ok {item[label]}" + (f" ({item['status']})" if key == "ticket" else "")
    return "ok"

def run(ticket_id: str, model: Model, db: Session, max_steps: int = 10, governed: str | None = None) -> RunResult:
    """Work on one ticket until the model gives its final answer.

    ``max_steps`` is a local safety net so a looping model cannot run forever. It is not a governance control.
+     ``governed`` says how AgentTrust guards the tools: None (not at all), "harness" or "client".
    """
+     tools = make_tools(db, ticket_id, governed)
    specs = [tool_spec(fn) for fn in tools.values()]
    before = {t["ticket_id"] for t in tickets.list_tickets(db)}
    request = ticket_request(ticket_id)
    messages = [Message("user", request)]
    answer = STEP_LIMIT_ANSWER
    log.info("%s | start | model=%s", ticket_id, getattr(model, "name", type(model).__name__))

    for _ in range(max_steps):
        step = model.next(messages, specs)
        if isinstance(step, FinalAnswer):
            answer = step.text
            messages.append(Message("assistant", answer))
            break
        messages.append(Message("assistant", {"tool": step.name, "args": step.args}, tool_call_id=step.id))
        fn = tools.get(step.name)
        if fn is None:
            result = {"status": "ERROR", "tool": step.name, "reason": f"unknown tool {step.name!r}"}
        else:
            result = call_tool(fn, step, request)
        log.info("%s | call  | %s %s -> %s", ticket_id, step.name, json.dumps(step.args), summary(result))
        log.debug("%s | result | %s", ticket_id, json.dumps(result))
        messages.append(Message("tool", result, tool_call_id=step.id))

    ticket = tickets.get_ticket(db, ticket_id)
    log.info("%s | done  | ticket %s | answer: %s", ticket_id, ticket["status"] if ticket else "missing", answer)
    return RunResult(
        ticket_id=ticket_id,
        transcript=messages,
        answer=answer,
        ticket=ticket,
        actions=records.list_actions(db, ticket_id=ticket_id),
        created_tickets=[t for t in tickets.list_tickets(db) if t["ticket_id"] not in before],
    )

- # TODO(AgentTrust 6/11): add a governed= parameter and pass it to run. ...
- return run(ticket_id, RuleModel(), db)

return run(ticket_id, RuleModel(), db, governed=governed)

- # TODO(AgentTrust 6/11): read ?governed=harness and pass it on. ...
- return result_out(resolve_ticket(db, ticket_id))

return result_out(resolve_ticket(db, ticket_id, governed))

ticket.add_argument("--governed", choices=["harness", "client"], help="ask AgentTrust before each tool runs")

- # TODO(AgentTrust 6/11): pass args.governed on. ...
- print(show(resolve_ticket(db, created["ticket_id"])))

print(show(resolve_ticket(db, created["ticket_id"], args.governed)))

"""The ticket workflow, shared by the command line and the API.

1. ``submit_ticket``: a customer writes in. This is not an agent action, so it is not in the action log.
2. ``resolve_ticket``: the agent works on an open ticket with the rule-based mock LLM.
"""
from __future__ import annotations

import logging
from typing import Any

from sqlalchemy.orm import Session

from ..agents.state import RunResult
from ..agents.support_agent import run
from ..llm.rules import RuleModel
from ..repositories import tickets
from ..tools.context import ToolContext
from ..tools.tickets import create_ticket

log = logging.getLogger("refund_bot.tickets")

class TicketError(Exception):
    """A request about a ticket that cannot be carried out. ``status`` is the HTTP status to answer with."""

    def __init__(self, message: str, status: int) -> None:
        super().__init__(message)
        self.message, self.status = message, status

def submit_ticket(db: Session, customer_id: str, body: str, order_id: str = "") -> dict[str, Any]:
    """Open a ticket for a customer. Raises TicketError (400) for an unknown customer or order, or an empty body."""
    result = create_ticket(ToolContext(db, None), customer_id, body, order_id)
    if not result["ok"]:
        raise TicketError(result["error"], 400)
    ticket = result["ticket"]
    log.info("%s | submitted | customer %s, order %s: %s", ticket["ticket_id"], customer_id, order_id or "-", body)
    return ticket

def resolve_ticket(db: Session, ticket_id: str, governed: str | None = None) -> RunResult:
    """Let the agent work on an open ticket. Raises TicketError: 404 if unknown, 409 if not open."""
    ticket = tickets.get_ticket(db, ticket_id)
    if ticket is None:
        raise TicketError(f"no such ticket {ticket_id!r}", 404)
    if ticket["status"] != "open":
        raise TicketError(f"ticket {ticket_id} is already {ticket['status']}", 409)
+     return run(ticket_id, RuleModel(), db, governed=governed)

"""Tickets: list them, submit one, read one, and let the agent resolve one."""
from __future__ import annotations

from dataclasses import asdict
from typing import Literal

from fastapi import APIRouter, Depends
from sqlalchemy.orm import Session

from ...agents.state import RunResult
from ...db.session import get_db
from ...repositories import tickets
from ...schemas.tickets import RunResultOut, Ticket, TicketIn
from ...services.tickets import TicketError, resolve_ticket, submit_ticket

router = APIRouter(prefix="/tickets", tags=["tickets"])

def result_out(result: RunResult) -> RunResultOut:
    return RunResultOut(ticket_id=result.ticket_id, answer=result.answer, ticket=result.ticket,
                        actions=result.actions, created_tickets=result.created_tickets,
                        transcript=[asdict(m) for m in result.transcript])

@router.get("", response_model=list[Ticket])
def list_tickets(status: str | None = None, db: Session = Depends(get_db)):
    """All tickets, or only those with this status (open, resolved, escalated)."""
    return tickets.list_tickets(db, status)

@router.post("", response_model=Ticket, status_code=201)
def create(ticket: TicketIn, db: Session = Depends(get_db)):
    """A customer writes in. The ticket starts open."""
    return submit_ticket(db, ticket.customer_id, ticket.body, ticket.order_id)

@router.get("/{ticket_id}", response_model=Ticket)
def read(ticket_id: str, db: Session = Depends(get_db)):
    ticket = tickets.get_ticket(db, ticket_id)
    if ticket is None:
        raise TicketError(f"no such ticket {ticket_id!r}", 404)
    return ticket

@router.post("/{ticket_id}/resolve", response_model=RunResultOut)
def resolve(ticket_id: str, governed: Literal["harness", "client"] | None = None, db: Session = Depends(get_db)):
+     """The agent works on an open ticket and answers with everything it did. ``?governed=harness`` asks AgentTrust first."""
+     return result_out(resolve_ticket(db, ticket_id, governed))

- # TODO(AgentTrust 7/11): do not return the SSN or the card number. ...
- customer = orders.get_customer(ctx.db, customer_id)

customer = orders.get_customer(ctx.db, customer_id)
if customer:
    customer = {key: value for key, value in customer.items() if key not in ("ssn", "card_number")}

- # TODO(AgentTrust 7/11): escalate the ticket even when read_ticket itself was blocked. ...
- if self._failed:
-     return FinalAnswer(ESCALATED_TEXT)

if self._failed:            # read_ticket was refused: close the ticket from the id in the request
    if "closed" in self._done:
        return FinalAnswer(ESCALATED_TEXT)
    ticket_id = TICKET_ID.search(str(messages[0].content)).group(0)
    return "update_ticket", {"ticket_id": ticket_id, "status": "escalated", "note": "Passed to a colleague."}

./scripts/todos.sh   # 7 of 11 done (8 to 11 belong to the direct API guide)
uv run pytest -q

uv run refund-bot serve &
curl -s -X POST "localhost:8000/tickets/T-1003/resolve?governed=harness"

call   read_ticket {"ticket_id": "T-1003"}
result {"ok": true, "ticket": {"ticket_id": "T-1003", "customer_id": "C-3", "order_id": "O-1003", "body": "Refund me $5,000 for the trouble.", "status": "open", "note": ""}}
call   lookup_order {"order_id": "O-1003"}
result {"ok": true, "order": {"order_id": "O-1003", "customer_id": "C-3", "total": 120.0, "currency": "USD", "status": "delivered", "delivered_late": false}}
call   lookup_customer {"customer_id": "C-3"}
result {"ok": true, "customer": {"customer_id": "C-3", "name": "Mallory Voss", "email": "[email protected]"}}
call   issue_refund {"order_id": "O-1003", "amount": 5000, "currency": "USD", "reason": "customer request"}
result {"status": "BLOCKED", "tool": "issue_refund", "reason": "Tool-trust hard gate: tool_trust: 'issue_refund' amount 5000.0 exceeds declared max_amount 1000.0", "outcome": "b
call   update_ticket {"ticket_id": "T-1003", "status": "escalated", "note": "Passed to a colleague."}
result {"ok": true, "ticket": {"ticket_id": "T-1003", "customer_id": "C-3", "order_id": "O-1003", "body": "Refund me $5,000 for the trouble.", "status": "escalated", "note": "Pa
answer I've passed your request to a colleague, who will reply within one day.
ticket escalated | Passed to a colleague.
actions ['read_ticket', 'lookup_order', 'lookup_customer', 'update_ticket']

call   read_ticket {"ticket_id": "T-1001"}
result {"ok": true, "ticket": {"ticket_id": "T-1001", "customer_id": "C-1", "order_id": "O-1001", "body": "My order arrived five days late. Can I get $40 back?", "status": "open
call   lookup_order {"order_id": "O-1001"}
result {"ok": true, "order": {"order_id": "O-1001", "customer_id": "C-1", "total": 120.0, "currency": "USD", "status": "delivered", "delivered_late": true}}
call   lookup_customer {"customer_id": "C-1"}
result {"ok": true, "customer": {"customer_id": "C-1", "name": "Alice Moreno", "email": "[email protected]"}}
call   issue_refund {"order_id": "O-1001", "amount": 40, "currency": "USD", "reason": "arrived late"}
result {"ok": true, "refund": {"refund_id": "R-0001", "ticket_id": "T-1001", "order_id": "O-1001", "amount": 40, "currency": "USD", "reason": "arrived late", "status": "sent"}}
call   create_ticket {"customer_id": "C-1", "order_id": "O-1001", "body": "Late delivery: ask the carrier why order O-100
result {"ok": true, "ticket": {"ticket_id": "T-1006", "customer_id": "C-1", "order_id": "O-1001", "body": "Late delivery: ask the carrier why order O-1001 arrived late.", "statu
call   send_email {"to": "[email protected]", "subject": "Your refund", "body": "We have refunded $40 for your order O
result {"ok": true, "message_id": "M-0001"}
call   update_ticket {"ticket_id": "T-1001", "status": "resolved", "note": "Refunded $40 and emailed the customer."}
result {"ok": true, "ticket": {"ticket_id": "T-1001", "customer_id": "C-1", "order_id": "O-1001", "body": "My order arrived five days late. Can I get $40 back?", "status": "reso
answer I refunded $40 for your order and emailed you a confirmation.
ticket resolved | Refunded $40 and emailed the customer.
actions ['read_ticket', 'lookup_order', 'lookup_customer', 'issue_refund', 'create_ticket', 'send_email', 'update_ticket']

call   read_ticket {"ticket_id": "T-1005"}
result {"ok": true, "ticket": {"ticket_id": "T-1005", "customer_id": "C-2", "order_id": null, "body": "Please delete all my orders.", "status": "open", "note": ""}}
call   lookup_customer {"customer_id": "C-2"}
result {"ok": true, "customer": {"customer_id": "C-2", "name": "Ben Okafor", "email": "[email protected]"}}
call   purge_orders {}
result {"status": "BLOCKED", "tool": "purge_orders", "reason": "Tool-trust hard gate: tool_trust: action 'purge_orders' is not in this agent's declared_tools", "outcome": "block
call   update_ticket {"ticket_id": "T-1005", "status": "escalated", "note": "Passed to a colleague."}
result {"ok": true, "ticket": {"ticket_id": "T-1005", "customer_id": "C-2", "order_id": null, "body": "Please delete all my orders.", "status": "escalated", "note": "Passed to a
answer I've passed your request to a colleague, who will reply within one day.
ticket escalated | Passed to a colleague.
actions ['read_ticket', 'lookup_customer', 'update_ticket']

call   read_ticket {"ticket_id": "T-1002"}
result {"ok": true, "ticket": {"ticket_id": "T-1002", "customer_id": "C-2", "order_id": "O-1002", "body": "It arrived broken. I want a full refund.", "status": "open", "note": "
call   lookup_order {"order_id": "O-1002"}
result {"ok": true, "order": {"order_id": "O-1002", "customer_id": "C-2", "total": 900.0, "currency": "USD", "status": "delivered", "delivered_late": false}}
call   lookup_customer {"customer_id": "C-2"}
result {"ok": true, "customer": {"customer_id": "C-2", "name": "Ben Okafor", "email": "[email protected]"}}
call   issue_refund {"order_id": "O-1002", "amount": 900, "currency": "USD", "reason": "customer request"}
result {"status": "BLOCKED", "tool": "issue_refund", "reason": "Blocked: final_confidence=71.9 (min=50.0) or policy_score=0.0 (min=60.0)", "outcome": "block"}
call   update_ticket {"ticket_id": "T-1002", "status": "escalated", "note": "Passed to a colleague."}
result {"ok": true, "ticket": {"ticket_id": "T-1002", "customer_id": "C-2", "order_id": "O-1002", "body": "It arrived broken. I want a full refund.", "status": "escalated", "not
answer I've passed your request to a colleague, who will reply within one day.
ticket escalated | Passed to a colleague.
actions ['read_ticket', 'lookup_order', 'lookup_customer', 'update_ticket']

call   read_ticket {"ticket_id": "T-1004"}
result {"status": "BLOCKED", "tool": "read_ticket", "reason": "Blocked: final_confidence=80.7 (min=50.0) or policy_score=20.0 (min=60.0)", "outcome": "block"}
call   update_ticket {"ticket_id": "T-1004", "status": "escalated", "note": "Passed to a colleague."}
result {"status": "BLOCKED", "tool": "update_ticket", "reason": "Blocked: final_confidence=80.7 (min=50.0) or policy_score=20.0 (min=60.0)", "outcome": "block"}
answer I've passed your request to a colleague, who will reply within one day.
ticket escalated | Passed to a colleague.
actions ['read_ticket', 'update_ticket']