Sable Agents

Sable Agents is an agent host where the agent cannot lie about what it did. You deploy a piece of code once; Sable runs it on a schedule or when you trigger it. Every run executes under the agent's own bounded API key, is metered, receipted, action-attested, and chained, and the receipt's content fingerprint equals the deploy-time code_fp, proving the deployed code is exactly what ran.

The agent gets SABLE_API_KEY (its own bounded key) and SABLE_API_BASE injected into its environment, so it can call Sable inference and sandboxes as itself, within its budget, policy, and circuit breaker. Its spend, its receipts, and its run chain are all attributable to that one key.

Deploy an agent

POST /v1/agents (session-authed) stores the code and schedules it.

curl https://api.buildsable.com/v1/agents \
-H "Authorization: Bearer $SABLE_SESSION_TOKEN" \
-H "Content-Type: application/json" \
-d '{
  "name": "price-watcher",
  "language": "python",
  "code": "import os, httpx\nprint(os.environ[\"SABLE_API_BASE\"])",
  "interval_secs": 3600,
  "spend_limit_usd": 5,
  "spend_window": "day",
  "circuit_breaker_usd": 2
}'

{
  "id": "agt_9b41…",
  "name": "price-watcher",
  "language": "python",
  "interval_secs": 3600,
  "enabled": true,
  "code_fp": "f2a91c04…",
  "api_key_id": "key_5d…",
  "run_chain": "agent:agt_9b41…",
  "note": "Code and env are stored sealed and destroyed on deletion. Scheduled-run output is discarded; receipts are the durable record."
}

• language: python (default), node, or bash.
• interval_secs: at least 60; at most 30 days. Omit it for a trigger-only agent that runs only when you ask.
• timeout_secs: per-run ceiling, up to 14400 (4 hours).
• env: an object of environment variables, sealed at rest alongside the code.
• network: off by default; the run cannot reach the internet without it.
• spend_limit_usd + spend_window, policy_id, circuit_breaker_usd: the bounds on the agent's key (see bounds below).
• vcpu, mem_mb, image: the sandbox resources the run gets, priced like any sandbox run.

code_fp is the fingerprint that ties everything together: every run receipt carries the content fingerprint of the code that ran, and for a hosted agent that fingerprint equals code_fp. Anyone holding a receipt can check that the deployed code, not something swapped in later, produced it.

Trigger a run

POST /v1/agents/{id}/trigger runs the agent now and returns the full sandbox response, including output:

curl -X POST https://api.buildsable.com/v1/agents/$AGENT_ID/trigger \
-H "Authorization: Bearer $SABLE_SESSION_TOKEN"

{
  "status": "succeeded",
  "exit_code": 0,
  "stdout": "https://api.buildsable.com/v1\n",
  "stderr": "",
  "cost_micro_usd": 231,
  "receipt": {
    "receipt": "eyJ2Ijoz…",
    "signature": "0x4f8c…",
    "signer": "0xA1b2…9F"
  }
}

The output comes back exactly once and is never stored. Scheduled runs discard their output entirely (see the §3 amendment below): if you need to see what an agent prints, trigger it manually; if you need durable evidence of what it did, that is what the receipts are for.

Endpoints

All session-authed (Authorization: Bearer sess_…).

The bounds

A hosted agent never spends on your root key. Deploying it mints a dedicated key with exactly the bounds you set, enforced on every call the agent makes:

• Budget: spend_limit_usd over a spend_window (day / week / month / total), the same refreshing budget as any scoped key. A daily budget renews; a total budget is a lifetime fuse.
• Policy: an optional policy_id binds the key to an existing policy.
• Circuit breaker: circuit_breaker_usd freezes the key when rolling spend velocity exceeds the cap, the same runaway-agent kill switch available on any key.

Disable an agent (gate) and its schedule stops; delete it and its key is revoked and its sealed code destroyed.

The proof story

Three artifacts make an agent's history checkable by someone who does not trust you, or Sable:

1. Receipts. Every run mints a signed, metadata-only receipt, verifiable through the public POST /v1/receipts/verify.
2. The code fingerprint. Each run receipt's content fingerprint equals the deploy-time code_fp, so a receipt proves which code produced it.
3. The run chain. Every run chains into the agent's own run chain at agent:{id}: a per-agent hash chain you can list at GET /v1/runs/agent:{id}, mint a signed run proof from, anchor, and export as a compliance audit pack.

Together: this code, under this key, ran these times, cost this much, and nothing was inserted or removed from the record.

The §3 amendment

Sable's privacy contract says submitted code is never persisted. Hosted agents are the one deliberate, disclosed exception: a scheduler cannot re-run what it does not hold. Plainly stated:

• Hosted-agent code and env are stored, AES-GCM sealed (ciphertext at rest), opened only at the moment of execution, never logged, and destroyed when the agent is deleted.
• Scheduled-run output is discarded. stdout and stderr from a scheduled run are returned to no one and stored nowhere. A manual trigger returns the output exactly once. The signed receipts are the durable record.

Nothing else about §3 changes: prompts, completions, and one-off sandbox code remain never-persisted, and no receipt or usage row ever contains content.

Scope and limits

Honest v1 scope: Sable Agents runs scheduled and manually triggered agents. It is not an always-on host; an agent is not a persistent process, it is a bounded run that starts, executes, and exits.

• Up to 20 agents per account.
• Schedule interval: at least 60 seconds, at most 30 days. Omit for trigger-only.
• Per-run timeout: up to 4 hours (timeout_secs ≤ 14400).
• Runs are priced like sandbox runs: vCPU-seconds plus GB-seconds of memory, plus whatever the agent itself spends calling Sable under its own key.