Routes, models, and context
A route represents a stable business scenario. A caller selects the route; it should not choose model secrets, the full tool catalog, or internal system instructions directly.
What a route composes
Section titled “What a route composes”A route can combine:
- a runtime target and target configuration;
- Tool Providers and exact allowlists;
- knowledge bases and retrieval policy;
- conversation, memory, and page-context policy;
- delivery, retry, budget, and other runtime rules.
A client can invoke only allowlisted routes. A route is not business authorization: the source backend must still authorize every resulting operation.
A model credential is not a scenario
Section titled “A model credential is not a scenario”A Model Credential stores an endpoint, API key, default model, and intended use. A route or target refers to it; business frontends, knowledge documents, and Agent Clients must not receive the model secret.
Different credentials can serve chat, vision, speech, or embedding. When the model changes behind a compatible contract, the business caller can continue to use the same route.
Sources of context
Section titled “Sources of context”| Context | Purpose | Authority boundary |
|---|---|---|
| User input | Current goal and explicit parameters | Untrusted input that still requires sanitization and validation |
| Conversation memory | Continue recent dialogue | Not a business database and cannot grant permission |
| Page context | Describe the page or object currently in view | Helps interpretation but does not prove the object is operable |
| Knowledge Base | Retrieve policies, help, and explanatory documents | Does not replace live orders, inventory, or account state |
| Capability projection | Tell the agent which tools it may request this turn | The backend can still reject every call |
Use a business tool for live facts. Do not treat retrieved documents or old conversation text as the final state of an order, stock item, or account.
Diagnose one route
Section titled “Diagnose one route”Check the client allowlist, target and credential reachability, explicit knowledge binding, Tool Provider and operation allowlists, the source of page cues, and the trace stage where execution stopped.