AI Agent 工具调用防护：用 Jev 辅助审批与风险检查

// Node.js 20+. Save as jev-example.mjs and run: node jev-example.mjs
// Set OMNIAKEY_API_KEY in the server/terminal environment first.
const key = process.env.OMNIAKEY_API_KEY;
if (!key) throw new Error("Set OMNIAKEY_API_KEY before running.");

const body = {
  "model": "jev-latest",
  "state": {
    "tool": "issue_customer_refund",
    "action": "Refund USD 680 after a disputed duplicate charge",
    "arguments_summary": [
      "order_id=ord_7429",
      "amount_usd=680"
    ],
    "side_effects": [
      "Moves funds",
      "Changes the order payment state"
    ],
    "safeguards": [
      "Customer identity and duplicate charge verified"
    ],
    "policy": [
      "Refunds above USD 500 require human approval"
    ],
    "reversibility": "partially_reversible"
  },
  "questions": {
    "action": {
      "type": "choice",
      "instructions": "Evaluate the proposed tool call using policy, side effects, safeguards, authorization, and reversibility. Treat policy thresholds and missing approvals as constraints. This evaluation does not grant permission to execute anything.",
      "criteria": {
        "allow": "The action is authorized, within policy, and supported by adequate safeguards.",
        "confirm": "Ask the user to confirm intent or missing details before proceeding.",
        "review": "A policy approval or human review is required before this action can proceed.",
        "deny": "The action violates policy, lacks required authority, or must not proceed."
      }
    },
    "risk": {
      "type": "score",
      "instructions": "Rate the financial, operational, and policy risk of the proposed action.",
      "criteria": [
        "Low: routine and within policy.",
        "Moderate: limited, reversible effects.",
        "High: material effects or approval requirements.",
        "Critical: unsafe, unauthorized, or irreversible effects."
      ]
    }
  }
};

const response = await fetch("https://api.omniakey.com/v1/alpha/search", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${key}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify(body),
  signal: AbortSignal.timeout(25_000),
});
if (!response.ok) {
  const retryAfter = response.headers.get("retry-after");
  throw new Error(`Jev HTTP ${response.status}; Retry-After: ${retryAfter ?? "not supplied"}`);
}
const result = await response.json();
console.log(JSON.stringify(result, null, 2));
// Inspect and validate the answer before connecting it to any external action.