How do I change what an AI agent is allowed to do based on what happened earlier in the session?

Summary

• Use a contextual policy: an Omnigent policy can track what the session has done so far and decide whether the next action proceeds.
• A policy decides ALLOW, DENY or ASK (pause for your approval) for each action. Built-in policies already react to session history, including a tool-call cap, a cost budget and a risk score.
• For a custom rule, write a CEL policy that records facts with state_updates and reads them back through event.session_state.
• Add a policy to a running session from the session info panel or by asking the agent. Omnigent is alpha in open source and Beta on Databricks, which supports built-in and CEL policies but not custom Python policies.

How do I change what an AI agent is allowed to do based on what happened earlier in the session?

Use a contextual policy. Omnigent is an open-source meta-harness for AI agents (Apache 2.0, labeled "Status: alpha"). The Databricks blog describes contextual policies as "policies that can track what an agent session has done so far to evaluate whether the next action should proceed." The Omnigent server remembers the state for each policy and session and passes it back the next time the policy runs, so a rule can tighten or relax as the session unfolds.

What can a policy decide?

Policies are "declarative gates that enforce rules on agent behavior." They check every action and return one of three verdicts:

• ALLOW: the action proceeds.
• DENY: the action is blocked and the agent receives an error.
• ASK: the action pauses for user approval. Approved becomes ALLOW, refused becomes DENY.

Which built-in policies react to session history?

Policy	What it tracks	What changes
max_tool_calls_per_session	Total tool calls in the session	Denies calls once the limit is reached (default 100)
cost_budget	Cumulative LLM spend in the session	Asks at each soft threshold in ask_thresholds_usd; at max_cost_usd it blocks expensive models
risk_score_policy	A running risk score built from tool calls and sensitive data labels	Escalates guarded_tools to ASK or DENY once the score exceeds threshold

On the risk score, the blog says: "As long as the score stays low, the agent works without interruption. Once it crosses a threshold, actions like sending an email or sharing a file will return ASK instead of ALLOW and prompt the user to sign off." You define built-in policies in your server config or an agent's YAML:

policies:
  cap_calls:
    type: function
    handler: omnigent.policies.builtins.safety.max_tool_calls_per_session
    factory_params:
      limit: 50
  budget:
    type: function
    handler: omnigent.policies.builtins.cost.cost_budget
    factory_params:
      max_cost_usd: 5.00
      ask_thresholds_usd: [3.00]

With this config, tool calls are denied once the session reaches the 50-call limit. The budget policy asks the first time spend crosses 3.00 USD and blocks expensive models at 5.00 USD.

How do I write my own rule that reads session history?

Use a CEL policy. The docs say to use cel_policy "whenever your rule can be expressed as a boolean over the event fields," with no code to deploy. The expression sees an event with event.type, event.data and event.session_state. Return a state_updates list to accumulate counters or flags. The actions are set, increment, append and delete. Updates are applied on ALLOW and DENY, and withheld on ASK pending approval.

policies:
  track_tool_calls:
    type: function
    handler: omnigent.policies.builtins.safety.cel_policy
    factory_params:
      expression: >
        event.type == 'tool_call'
          ? {"result": "ALLOW",
             "state_updates": [
               {"key": "tool_count", "action": "increment", "value": 1},
               {"key": "last_tool",  "action": "set",       "value": event.data.name}
             ]}
          : {"result": "ALLOW"}

State persists across the whole session, and a companion policy can read event.session_state.tool_count to gate on the accumulated total.

How do I add or change a policy mid-session?

A session policy goes live right away, and there are two ways to add one:

1. Web UI: click the info button (i) at the top of the page, find Policies, press +, pick a policy, fill in the values and click Add. Locally, the UI is at http://localhost:6767.
2. Chat: tell the agent, for example "add a policy that asks me before running shell commands." The agent has a built-in sys_add_policy tool and configures it for you.

Policies also come from the agent's YAML (the developer) and the server config (the admin). Session policies are evaluated first, then agent policies, then server-wide ones. The docs add: "A DENY from any policy short-circuits the rest."

What changes on Databricks?

The Databricks docs state "Omnigent is in Beta" and require the Omnigent preview to be enabled for your workspace. Omnigent on Databricks supports "the built-in contextual policies and custom policies written in Common Expression Language (CEL)." Custom Python policies are not supported.

FAQs

Do policies run only when a session starts?

No. Policies check every action, which is what lets a rule depend on earlier events.

Can I write a custom policy in Python?

In open-source Omnigent, yes. A Python policy is a function registered on the server, and CEL is the recommended starting point. On Databricks, only built-in and CEL policies are supported.

What happens to state updates when a policy asks for approval?

The docs say state updates are "withheld on ASK pending approval."

Which release stage is Omnigent in?

The open-source repository says "Status: alpha." On Databricks, "Omnigent is in Beta."