Action Classifier

The action classifier assigns a risk level to an action identifier presented by a caller. It is a lookup utility, not a universal interceptor. Execution paths must explicitly call it and separately enforce any audit, policy, or approval decision.

Overview

Each identifier passed to classifyAction() resolves to one of three levels:

Level	Description	Classifier result
`read`	No side effects	Returned as `read`
`mutate`	Modifiable side effects, usually reversible	Returned as `mutate`
`destructive`	Irreversible or high-risk	Returned as `destructive`

Fail-closed principle: Unknown actions default to destructive. If an action is not in the registry, it is treated as the highest risk level. Registry locking: After bootstrap completes, lockRegistry() is called to prevent runtime classification changes by source integrations. Once locked, registerAction() throws an error.

classifyAction() and requiresConfirmation() do not create an approval request or pause execution. Human approval occurs only on an execution path that explicitly calls ApprovalGate.requestApproval(), and only when the daemon has wired that gate for the path.

Source: packages/core/src/security/action-classifier.ts. 178 registered actions across 21 categories.

API

classifyAction

function classifyAction(actionType: string): ActionClassification

Returns the registered classification for an action, or "destructive" for unknown actions (fail-closed).

requiresConfirmation

function requiresConfirmation(actionType: string): boolean

Returns true if the action is classified as "destructive". This is a boolean policy signal only; it does not invoke the approval gate.

registerAction

function registerAction(
  actionType: string,
  classification: ActionClassification
): void

Register a new action type with its classification. Overwrites any existing registration. Throws Error if the registry has been locked via lockRegistry().

lockRegistry

function lockRegistry(): void

Locks the registry, preventing any further registrations. Idempotent — calling multiple times is a no-op.

isRegistryLocked

function isRegistryLocked(): boolean

Returns true if lockRegistry() has been called.

Usage Example

import {
  classifyAction,
  requiresConfirmation,
  registerAction,
  lockRegistry,
} from "@comis/core";

// Register source-integrated action identifiers during bootstrap
registerAction("custom.export", "mutate");
registerAction("custom.purge", "destructive");

// Lock after bootstrap -- no more registrations allowed
lockRegistry();

// Classify actions at runtime
classifyAction("file.read");       // "read"
classifyAction("memory.delete");   // "destructive"
classifyAction("unknown.action");  // "destructive" (fail-closed)

// Check confirmation requirement
requiresConfirmation("file.read");     // false
requiresConfirmation("system.shutdown"); // true

Complete Action Registry

All 178 registered actions from ACTION_REGISTRY, grouped by category.

File Operations (4 actions)

Action	Classification
`file.read`	read
`file.write`	mutate
`file.create`	mutate
`file.delete`	destructive

Memory Operations (12 actions)

Action	Classification
`memory.search`	read
`memory.get`	read
`memory.search_files`	read
`memory.get_file`	read
`memory.stats`	read
`memory.browse`	read
`memory.export`	read
`memory.store`	mutate
`memory.update`	mutate
`memory.delete`	destructive
`memory.clear`	destructive
`memory.flush`	destructive

Config Operations (10 actions)

Action	Classification
`config.read`	read
`config.schema`	read
`config.history`	read
`config.diff`	read
`config.update`	mutate
`config.patch`	destructive
`config.apply`	destructive
`config.reset`	destructive
`config.rollback`	destructive
`config.gc`	destructive

Session Operations (15 actions)

Action	Classification
`session.get`	read
`session.list`	read
`session.history`	read
`session.status`	read
`session.run_status`	read
`session.export`	read
`session.create`	mutate
`session.send`	mutate
`session.send_wait`	mutate
`session.spawn`	mutate
`session.compact`	mutate
`session.destroy`	destructive
`session.delete`	destructive
`session.new`	destructive
`session.reset`	destructive

Scheduling Operations (7 actions)

Action	Classification
`cron.list`	read
`cron.status`	read
`cron.runs`	read
`cron.wake`	read
`cron.add`	mutate
`cron.update`	mutate
`cron.remove`	destructive

Messaging Operations (6 actions)

Action	Classification
`message.fetch`	read
`message.send`	mutate
`message.reply`	mutate
`message.react`	mutate
`message.edit`	mutate
`message.delete`	destructive

Agent Management (7 actions)

Action	Classification
`agents.list`	read
`agents.get`	read
`agents.update`	mutate
`agents.resume`	mutate
`agents.create`	destructive
`agents.delete`	destructive
`agents.suspend`	destructive

Channel Management (5 actions)

Action	Classification
`channels.list`	read
`channels.get`	read
`channels.enable`	destructive
`channels.disable`	destructive
`channels.restart`	destructive

Token Management (4 actions)

Action	Classification
`tokens.list`	read
`tokens.create`	destructive
`tokens.revoke`	destructive
`tokens.rotate`	destructive

Browser Operations (14 actions)

Action	Classification
`browser.status`	read
`browser.tabs`	read
`browser.profiles`	read
`browser.snapshot`	read
`browser.console`	read
`browser.start`	mutate
`browser.stop`	mutate
`browser.navigate`	mutate
`browser.open`	mutate
`browser.focus`	mutate
`browser.close`	mutate
`browser.screenshot`	mutate
`browser.pdf`	mutate
`browser.act`	mutate

Discord Actions (11 actions)

Action	Classification
`discord.guild_info`	read
`discord.channel_info`	read
`discord.pin`	mutate
`discord.unpin`	mutate
`discord.unban`	mutate
`discord.role_add`	mutate
`discord.role_remove`	mutate
`discord.set_topic`	mutate
`discord.set_slowmode`	mutate
`discord.kick`	destructive
`discord.ban`	destructive

Telegram Actions (12 actions)

Action	Classification
`telegram.chat_info`	read
`telegram.member_count`	read
`telegram.get_admins`	read
`telegram.pin`	mutate
`telegram.unpin`	mutate
`telegram.poll`	mutate
`telegram.sticker`	mutate
`telegram.set_title`	mutate
`telegram.set_description`	mutate
`telegram.unban`	mutate
`telegram.ban`	destructive
`telegram.promote`	destructive

Slack Actions (12 actions)

Action	Classification
`slack.channel_info`	read
`slack.members_list`	read
`slack.pin`	mutate
`slack.unpin`	mutate
`slack.set_topic`	mutate
`slack.set_purpose`	mutate
`slack.unarchive`	mutate
`slack.invite`	mutate
`slack.bookmark_add`	mutate
`slack.archive`	destructive
`slack.create_channel`	destructive
`slack.kick`	destructive

WhatsApp Actions (11 actions)

Action	Classification
`whatsapp.group_info`	read
`whatsapp.group_invite_code`	read
`whatsapp.group_update_subject`	mutate
`whatsapp.group_update_description`	mutate
`whatsapp.group_participants_add`	mutate
`whatsapp.group_demote`	mutate
`whatsapp.group_settings`	mutate
`whatsapp.profile_status`	mutate
`whatsapp.group_participants_remove`	destructive
`whatsapp.group_promote`	destructive
`whatsapp.group_leave`	destructive

Skills Operations (9 actions)

Action	Classification
`skill.list`	read
`skill.load`	read
`skill.scan`	read
`skill.scan.reject`	read
`skill.prompt.load`	read
`skill.install`	mutate
`skill.execute`	mutate
`skill.prompt.invoke`	mutate
`skill.uninstall`	destructive

Model Operations (5 actions)

Action	Classification
`model.fallback`	read
`model.list`	read
`models.list`	read
`models.test`	read
`model.switch`	mutate

Graph Pipeline Operations (8 actions)

Action	Classification
`graph.status`	read
`graph.load`	read
`graph.list`	read
`graph.define`	mutate
`graph.execute`	mutate
`graph.save`	mutate
`graph.cancel`	destructive
`graph.delete`	destructive

Sub-agent Operations (3 actions)

Action	Classification
`subagent.list`	read
`subagent.wait`	read
`subagent.kill`	mutate
`subagent.steer`	mutate

Command Operations (3 actions)

Action	Classification
`command.parse`	read
`command.context`	read
`command.status`	read

Web and Media Operations (6 actions)

Action	Classification
`web.fetch`	read
`web.search`	read
`image.analyze`	read
`media.transcribe`	read
`media.describe_video`	read
`media.extract_document`	read

System and Infrastructure Operations (14 actions)

Action	Classification
`status.check`	read
`log.read`	read
`tool.execute`	read
`gateway.status`	read
`env.list`	read
`daemon.setLogLevel`	mutate
`tts.synthesize`	mutate
`canvas.present`	mutate
`canvas.eval`	mutate
`system.shutdown`	destructive
`system.exec`	destructive
`gateway.restart`	destructive
`gateway.update`	destructive
`env.set`	destructive

Configuration

The ActionConfirmationConfigSchema records confirmation policy signals for execution paths that explicitly consult it:

Field	Type	Default	Description
`requireForDestructive`	`boolean`	`true`	Mark destructive actions for confirmation on paths that consult this setting
`requireForSensitive`	`boolean`	`false`	Mark sensitive actions for confirmation on paths that consult this setting
`autoApprove`	`string[]`	`[]`	Identifiers a consulting path may exempt from confirmation

These settings do not install a global action guard. A tool or RPC path that does not consult them is unaffected.

Source: packages/core/src/config/schema-security.ts — ActionConfirmationConfigSchema Zod schema.

security:
  actionConfirmation:
    requireForDestructive: true
    requireForSensitive: false
    autoApprove:
      - config.patch
      - session.new

Classification Summary

Classification	Count	Examples
`read`	69	`file.read`, `memory.search`, `config.read`, `browser.status`
`mutate`	67	`file.write`, `message.send`, `cron.add`, `browser.navigate`
`destructive`	42	`file.delete`, `memory.clear`, `system.shutdown`, `discord.ban`

Security Model

Defense-in-depth security architecture

Safe Path

Path traversal prevention

Tool Security

SSRF guard, tool policies, content scanner

CLI

Configuration

Security

Gateway and APIs

Action Classifier

Overview

API

classifyAction

requiresConfirmation

registerAction

lockRegistry

isRegistryLocked

Usage Example

Complete Action Registry

Configuration

Classification Summary

Security Model

Safe Path

Tool Security

​Overview

​API

​classifyAction

​requiresConfirmation

​registerAction

​lockRegistry

​isRegistryLocked

​Usage Example

​Complete Action Registry

​Configuration

​Classification Summary

Security Model

Safe Path

Tool Security

Overview

API

classifyAction

requiresConfirmation

registerAction

lockRegistry

isRegistryLocked

Usage Example

Complete Action Registry

Configuration

Classification Summary