Skip to main content
Last updated on
Tags:
Options
Open in ChatGPTAsk ChatGPT about this pageOpen in ClaudeAsk Claude about this page

Event Types

OpenBox classifies every agent operation into one of 21 semantic operation types, grouped as HTTP (6), LLM (4), DB (5), File (4), and Other (2). The platform derives them from raw SDK telemetry (OpenTelemetry spans) for observability and analytics. Governance policies are authored against an agent's risk tier and event type (see Policies); these semantic types describe what an operation did.

Operation Categories​

HTTP​

TypeDescription
http_getHTTP GET request
http_postHTTP POST request
http_putHTTP PUT request
http_patchHTTP PATCH request
http_deleteHTTP DELETE request
httpGeneric/unclassified HTTP request

LLM​

TypeDescription
llm_completionCompletion / chat call to a language model
llm_embeddingGenerate embeddings from text
llm_tool_callModel-invoked tool/function call
llm_gen_aiGenerative-AI operation (OTel gen_ai.*)

Database​

TypeDescription
database_selectRead rows (SELECT)
database_insertInsert rows
database_updateUpdate rows
database_deleteDelete rows
database_queryOther/unclassified query

File​

TypeDescription
file_readRead from filesystem
file_writeWrite to filesystem
file_openOpen a file handle
file_deleteDelete a file

Other​

TypeDescription
mcp_tool_callModel Context Protocol client tool call
internalFallback for spans with no specific classification

Using Event Types​

In Policies​

Author policies against an agent's risk tier and event type:

package openbox

import future.keywords.if
import future.keywords.in

default result := {"decision": "ALLOW", "reason": ""}

# Require approval for database writes by Tier 2+ agents
result := {"decision": "REQUIRE_APPROVAL", "reason": "Database writes require review"} if {
    input.risk_tier >= 2
    input.event_type == "db.write"
}

# Block destructive operations for the lowest-trust tier
result := {"decision": "BLOCK", "reason": "Destructive operations blocked for Tier 4"} if {
    input.risk_tier == 4
    input.event_type == "db.write"
}

In Monitoring​

Filter sessions by event type:

  • View all http_post events
  • Track database_update frequency
  • Alert on file_delete spikes

Event Metadata​

Each event includes:

{
  "event_id": "evt_abc123",
  "type": "database_update",
  "timestamp": "2026-02-26T09:14:32.001Z",
  "session_id": "ses_xyz789",
  "agent_id": "agt_def456",

  "target": "customers.update",
  "parameters": {
    "table": "customers",
    "operation": "update",
    "record_count": 1
  },

  "governance": {
    "decision": "ALLOW",
    "policies_evaluated": ["default", "customer-data"],
    "trust_score_at_time": 87
  },

  "telemetry": {
    "duration_ms": 45,
    "trace_id": "abc123def456"
  }
}