build an agent manifest without hand-writing the JSON
Agent identity
used as the KV key: schema:<agent_id>
What it's allowed to do
Comma-separated. Anything not listed here gets blocked at the Worker.
leave blank to allow any endpoint (not recommended for production). Use addresses like api.client.com/menu, or *.client.com for any subdomain
Limits
No outbound network access beyond allowed endpoints
Cannot write to shared/cross-agent storage
Cannot spawn sub-agents
These three are recorded in the manifest as your stated policy. The Worker doesn't enforce them: what it enforces is the allowed actions and endpoints, the limits, the payment guard and the flagged phrases.
Payment guard
Blocks the same charge (same amount, recipient, item) from firing more than N times in the window. Applies to the action named create_payment.
Override guard
Comma-separated phrases that trigger an automatic block + alert when found in agent output.
Output
{ /* fill in the form above and hit Generate */ }
Manual deploy: wrangler kv:key put --binding=WARILYWATCH_KV "schema:<agent_id>" --path=manifest.json
Then add the agent_id to the agents:list array in the same KV namespace.
Deploy straight to your Worker
Skips the manual wrangler command — POSTs this manifest directly to your deployed Worker, which writes it to KV and adds it to the roster.
just the address, https:// is already there
Remember token on this device
Test enforcement
Fires real calls against the live agent's /enforce endpoint. Uses the Worker address, admin token and Agent ID above — deploy first. Any blocked or flagged test auto-suspends the agent (that's the containment design working as intended) — use Resume below to bring it back afterward.
Your real agent calls /enforce with Authorization: Bearer <ENFORCE_KEY>. Give the agent only the ENFORCE_KEY, never the admin token.