Context, control, and security

Context

An agent receives its role on work.claim and the complete assignment on work.get_context: run input, Flownix source_node_ids, workflow node config, role instructions, predecessor outputs, input artifacts, deliberation ID, and the ballot when applicable. Input and output schemas document intent but are not runtime validators.

Leases, retries, and timeouts

config.lease_seconds controls how long an agent owns work; heartbeat renews it. retry_policy.max_attempts controls how many failures or expired leases can return work to the queue. Top-level node timeout_seconds limits an agent step. Vote and human approval deadlines use their node config.

Policies

The runtime enforces tools policies on work.* and council.* calls made by a leased role. deny beats allow. require_approval is supported only for work.complete and moves the run to waiting_for_user.

data_access, voting, budget, execution, approval, retention, and privacy policies are stored but not enforced and return policy.not_enforced. They cannot intercept an external agent's files, shell, network, or other MCP servers; express those boundaries in role instructions and host permissions.

Budgets and audit

The version budget and optional tighter run budget cover max_run_duration_seconds, max_work_items, max_tokens, and max_cost_usd. Tokens and cost count only usage reported by agents. Any exhausted limit fails the run with budget.exceeded. harness.get_run shows the snapshot, usage, remaining budget, steps, and outputs.