Skip to main content

Prompt Control API

/api/sable-prompt is a lead-only bridge to the cma-admin Edge Function's prompt-governance actions. The Edge function owns the Anthropic key and independently re-verifies the same JWT; this route's job is to keep the browser talking to the app's own origin and to narrow the allowed action surface to prompt tuning only — it cannot be used to reach any other cma-admin action.

Allowed actions​

{ "action": "get_prompt" }
{ "action": "stage_prompt", "base": "candidate base prompt" }
{ "action": "set_base_prompt", "base": "approved base prompt" }
{ "action": "propose_base_prompt", "base": "candidate base prompt" }
{ "action": "prompt_versions" }
{ "action": "rollback_prompt", "version_row_id": "version-row-uuid" }
{ "action": "apply_prompt_rules" }

Two ways to change the base prompt, on purpose​

  • set_base_prompt — a direct promote, admin override. Requires SABLE_PROMPT_OWNER.
  • propose_base_prompt — self-serve: creates a pending approval instead of promoting directly, so a different lead approves before it goes live. This exists specifically so the person proposing a prompt change isn't also the only check on it.

Why apply_prompt_rules is its own action​

Retiring a learned rule only changes what the next fold emits — the live prompt keeps the rule until a fold actually runs. Folding used to happen only as a side effect of approving some other, unrelated rule, which meant a session spent purely retiring rules could end with the prompt completely unchanged and nothing left to do about it. apply_prompt_rules lets an operator force a fold explicitly.

The gate above the gate​

Every action here requires lead access to reach the route at all, and set_base_prompt / rollback_prompt additionally require isPromptOwner — the SABLE_PROMPT_OWNER allowlist described in Security Posture. propose_base_prompt deliberately does not require prompt ownership, because its whole point is to let someone other than the owner suggest a change for the owner to approve.

Where the code lives​

  • sable-agents-demo/web/api/sable-prompt.js
  • sable-agents-demo/web/api/_prompt_owner.js
  • sable-agents-demo/supabase/functions/cma-admin/index.ts — the Edge function this route bridges to
  • cma-admin reference for the full action table