ACTIONDOCK / FIELD NOTES
SAFE AGENT ACTIONS.
EXPLAINED.
Technical and operational guidance for moving AI agents from read-only work to supervised API writes.
- 01READ ↗
Webhook Signature Verification for AI Agent Callbacks
Verify AI-agent webhook callbacks with the raw body, HMAC-SHA256, a timestamp window, constant-time comparison, and atomic delivery deduplication.
- 02READ ↗
AI Agent Audit Trail: What to Log for API Actions
Build an AI agent audit trail that records intent, policy, approval, execution, and uncertain outcomes without leaking secrets or overstating provider evidence.
- 03READ ↗
Give AI Agents API Access Without Exposing API Keys
Keep a target API credential outside the model context while an AI agent submits bounded, owner-reviewed writes through a server-side gateway.
- 04READ ↗
AI Agent API Retries: Idempotency and Unknown Outcomes
Learn when an AI agent can retry an API write, what an idempotency key protects, and how to reconcile execution_unknown without duplicate side effects.
- 05READ ↗
AI Agent API Security: Make the First Safe Write
Learn how to move an AI agent from read-only recommendations to one policy-checked, owner-approved API write without exposing the target credential.
- 06READ ↗
Human-in-the-Loop Approval for AI Agent Actions
A practical design for AI-agent approvals that bind a human decision to one exact API request, preserve pending state, and invalidate stale reviews.
- 07READ ↗
MCP Server Security for Write-Enabled Tools
A production MCP security checklist for write-enabled tools: trusted servers, least privilege, approval gates, credential isolation, and action records.