Docs / Concepts / Guard and risk tiers
Guard and risk tiers
The guard looks at one thing, the risk tier of the action. Each app declares its own tiers.
Each action that the agent wants goes through the guard. The guard does not try to read intent. It looks only at the risk tier. The app declares the tier for each capability.
Three tiers
| Tier | Examples | What the guard does |
|---|---|---|
local: local, can undo |
Change the light, set a timer | Does not ask. The light blinks once after the action |
remote: leaves the device, can undo |
Look up a flight, write a draft | Asks the first time: this time, always, or no. After “always”, it does not ask again |
irreversible: cannot undo |
Pay, send, unlock | Asks every time and accepts only a physical key press. A spoken “yes” does not count |
The person gives standing permissions and can take them back at any time. Irreversible actions have no standing permission. The wait for a key press has a time limit. When the time ends, the action does not run.
One log line for each action
When the guard allows an action, it writes one line to the log after the action. The log is on the device and is kept for 30 days. For an irreversible action, the line also records who pressed the key.
How to declare the tier
{
"name": "order.pay",
"description": "Pay for the order",
"inputSchema": { "type": "object" },
"_meta": { "qing": {
"risk": "irreversible",
"preview": "Pay {amount} to {shop}"
} }
}preview is the sentence that the device reads to the person before confirmation. Irreversible capabilities must have a preview.
A wrong tier is the worst error
If a payment action declares remote, the person can lose money without a key press. If you are not sure, declare the higher tier.
Apps with network have no local tier
If an app has network = true in its manifest, the system treats its local actions as remote. The app can leave the device, so the system does not trust that an action stays local. To make an action that never asks, put it in an app without network.
No undo
QingOS has no general undo. To let the person go back, give an opposite capability, for example list.add and list.remove. When the person says “undo”, the model uses it.
MCP servers from other people
You can connect an MCP server that has no _meta.qing. The system treats its read-only actions as remote and all its other actions as irreversible.