Skip to main content
A patch is not a bare API. It is a declaration: what the capability is called, what it takes, what it returns, how risky it is, and how it behaves when the agent uses it. That declaration is what the model sees, and what the runtime enforces. Patches are authored under Patches in the dashboard, then wired into an agent.

​
Three kinds of binding

Only the first reaches your infrastructure. An agent built entirely from the other two never needs a connection — which is what makes the Quick start work with nothing hosted.

​
Interaction

How the call behaves in the conversation: proposed_action is the one people miss. It is for work Patchwork cannot do — something that must happen in your UI, or on a device, or by a human. The run waits in awaiting_outcome until you say what happened.

​
Rendering a result

A patch can set Render as to a kind (e.g. agents, table, card). When it does, the patch’s result is emitted as a rich-message data block of that kind — structured data your UI renders — instead of only reaching the model. Leave it blank for a plain-text reply. It’s optional and independent of everything else here.

​
Risk

Every patch declares a base risk: low, medium, high, or critical. An agent can raise it but the effective level is never lower than the declaration. Risk does not block anything by itself. It is recorded on every tool call, surfaced in pending_confirmation, and is the natural input to how prominently your UI asks for approval.

​
Writes and gates

A customer_endpoint patch bound to POST, PUT, PATCH, or DELETE is a write. Writes are where the guardrail matters, and the guardrail is the permission you set when wiring the patch to an agent: The same patch can be Always allow on one agent and Always ask on another. The permission belongs to the wiring, not the patch. The permission is also what decides whether a write leaves the building: only an Always allow write is exported to a user’s own AI client, because that door cannot pause to ask.

​
Built-in primitives

Seven patches ship with the platform and cannot be overridden — the keys are reserved: Trying to author a patch with one of these keys is rejected.

​
Redaction

A patch can declare fields to strip from results before they are stored or shown to the model. Use it for anything your endpoint returns that the agent has no business reasoning over — full card numbers, internal identifiers, tokens. Redaction applies to the stored trace as well as the model’s context.