Manifest

An agent is defined by a single agent.acl manifest. The manifest is a set of top-level blocks whose order does not matter: build selects the output shape, filesystem and network decide what the agent's components can reach, provider declares the model providers, agent defines the agent itself, tool and skill extend what it can do, http_server exposes it over the network, and locals factors out repeated values. Each block has its own reference page linked below.

The manifest below is a complete example that uses every top-level block:

locals {
  version = "1.0.0"
}

build {
  archetype = "standalone"
}

runtime {
  default_tenant_id = "default"
}

filesystem {
  mounts = [
    {
      path = "/"
      backend = { kind = "memory" }
    }
  ]
}

network {
  policy {
    allow = [
      {
        protocol = "https"
        hostname = "api.example.com"
      }
    ]
  }
}

provider "anthropic" {
  kind   = "anthropic"
  models = ["claude-haiku-4-5"]

  config {
    api_key = secret(runtime("ANTHROPIC_API_KEY"))
  }
}

agent "assistant" {
  graph {
    type = "react"
  }

  version     = locals.version
  description = "A helpful assistant."

  prompt = "You are {{ agent_name }}, a concise and helpful assistant."

  capabilities      = ["math"]
  capability_policy = "locked"

  model {
    provider = "anthropic"
    name     = "claude-haiku-4-5"
  }
}

tool "adder" {
  kind         = "javascript"
  source       = "./tools/math"
  capabilities = ["math"]
}

tool "planner" {
  kind = "a2a"
  url  = runtime("PLANNER_A2A_URL", "https://planner.example.com")
}

skill "arithmetic" {
  source = "./skills/arithmetic"
}

http_server {
  host = runtime("HTTP_HOST", "127.0.0.1")
  port = runtime("HTTP_PORT", 8080)

  protocol {
    ag_ui {}
  }
}

To assemble a manifest step by step rather than from a finished example, see Author a manifest. For the concepts behind build-time versus runtime values, see The manifest.

File-backed string values

Use file("path") in agent.acl wherever a field expects a string value. The file's UTF-8 text is read while building the agent, so the file is not needed when the compiled agent runs. Relative paths are resolved from the directory containing agent.acl.

For example, inside an agent block:

description = file("./copy/description.txt")
prompt      = file("./prompts/system.md")

A quoted path without file(...) is an ordinary string. You can also use file(...) inside list and object values, including the content of an individual prompt message.

Runtime values

A runtime("NAME", default) value is read from the environment variable NAME when the binary starts. Some fields are runtime values when omitted; their block page lists the variable under Environment variables.

A scalar is read as text. A list, set, map, or object is read as JSON:

NETWORK_ALLOW_METHODS='["GET","POST"]'
NETWORK_HEADERS='{"X-Env":"production"}'

A nested value is set on its own by appending __ and its path to the variable name. A numeric segment is a list index. Any other segment is a lowercased map key, so keys containing capital letters or - are set through the JSON form.

NETWORK_ALLOW_PATTERNS__0__HOSTNAME=api.example.com

A field whose manifest value contains a nested runtime() keeps its fixed parts. Only the nested runtime values are read from the environment.

Expression values

An expression("source") value is evaluated by the agent while it runs, not while building it. The field that holds it decides the expression language and the values the expression can read.

Only fields whose reference lists expression() accept it. Anywhere else, the manifest fails to load with a type error. Locals are interpolated into source as into any other string.

Blocks