Intent / Risk Classifier

Reference Architecture

The Intent / Risk Classifier turns a raw user message and Run Context into a canonical intent name plus the catalog’s v1 risk_class compatibility projection. It does not collapse a capability’s native ActionRisk into a single authoritative tier.

This is a deployment component design. The reference compiler uses request.input.intent when supplied, otherwise a minimal deterministic keyword heuristic; it does not implement the catalog classifier or produce the candidate ClassifierVerdict. Production validates declared and inferred intents before compilation and retains the classifier/catalog pins. Confidence and routing labels do not grant authority, change a capability’s native risk or lower mandatory control profiles.

Definition

A small, fast classifier—typically a pinned model or deterministic ruleset for known channels—that emits an intent in the catalog plus its v1 risk_class. Outputs enter the Run Context before deterministic policy resolution and tool surfacing. Capability declarations, concrete arguments, authority, reversibility, interaction, and data scope are evaluated separately.

Why it exists

Without a single classification step, every component re-derives intent from prompts and they drift apart. The classifier centralizes the mapping so the Compiler, Planner, and Critic agree on what the request actually is.

Inputs

• RunContext.intent (if the caller declared one — preferred; classifier validates)
• invokeAgent.input.message, channel, locale
• invokeAgent.input.context (any structured signals already present)
• Intent catalog snapshot

Outputs

• Canonical intent_id from the Intent-Task Catalog
• v1 risk_class ∈ read_only / local_write / network / delegated / destructive
• confidence and alternatives[] for the Critic to consider

How it works

1. If RunContext.intent is supplied and matches the catalog, validate and return it (preferred path).
2. Otherwise, run the classifier against the message + channel + locale; produce top-k candidates with confidence.
3. Apply a pinned complete deterministic tie order, such as configured specificity/priority, semantic version and stable ID. Return an explicit ambiguous/unsupported result where the policy cannot resolve it; do not consult ambient time or depend on incidental iteration order.
4. Cross-check the intent’s v1 risk_class against RunContext.safety_mode; refuse an unsupported projection. Later policy still evaluates each surfaced capability’s native action-risk dimensions independently.

Derive actual workflow features and exact required controls independently of classifier wording. At dispatch, separately verify current scoped authority/revocation, full action approval where required, active boundary, actual data route and aggregate budget. A route change cannot expand a personal standing mandate, grant cross-tenant access or mint child/retry capacity. A classifier/routing-policy expression error must be surfaced as non-success; a confidence threshold cannot turn it into allow.

Failure modes

• Classifier confidence below threshold — the Critic surfaces a clarifying question instead of guessing.
• Intent resolves to a deprecated entry — refuse and emit a typed error.
• V1 risk-class conflict between intent and safety_mode — refuse before compilation.
• Missing native risk on a capability governed by action_risk_policy — fail closed rather than inferring a dimension from the v1 tier.

Operational concerns

• Classifier model pinned per environment; upgrades go through release-gate evaluation.
• p50 / p99 latency budget folded into the Planner timeout.
• Per-tenant classifier quotas.
• Drift monitoring against golden classification sets.
• Keep model-based classification outside the pure reference compiler. Authenticate input provenance, leave user/channel text data-only, govern actual model recipients/processors and pin request/response artifacts for replay under authorized retention.

Evaluation metrics

• Top-1 precision/recall on golden intents.
• Calibration of confidence buckets.
• Refusal rate (clarifying-question routes).
• V1 risk-class drift detection plus per-dimension native-risk coverage.