SPADE / Agent access

Agent-compatible practice

Professional services with a clear machine handoff.

SPADE works with human-led, agent-assisted, and human-agent teams. Authorized agents may discover services and submit scoped requests. A named human or organization remains accountable.

Read the request contract OpenAPI schema
Norsk introduksjon

Åpen for agent-initierte oppdrag, med menneskelig ansvar

Agenter kan finne relevante tjenester og sende en strukturert forespørsel til SPADEs private innboks. En navngitt person eller virksomhet må ha autorisert henvendelsen, og ingen API-innsending starter fakturerbart arbeid eller gir tilgang til kundesystemer.

Dette passer blant annet for innkjøpsagenter, styringsagenter, sikkerhetsarbeidsflyter og team der mennesker og agenter deler analyse- og dokumentasjonsarbeid.

Requestable capabilities

A precise catalog, not an open-ended promise

These identifiers are canonical API values. Availability means a request may enter review—not that the work is automatically accepted.

security.risk_review

Security and risk review

Scope a risk assessment, architecture review, ISO 27001 activity, or practical security decision.

privacy.dpia_triage

DPIA triage

Determine whether a processing activity needs deeper privacy assessment and what evidence is missing.

privacy.vendor_review

Vendor and processor review

Review privacy, security, contractual, and data-flow questions around a supplier.

ai_act.classification_review

AI Act classification review

Request a human-reviewed assessment of roles, use case, risk category, and documentation needs.

ai_governance.policy_review

AI governance and policy

Review AI policy, inventory, decision rights, human oversight, or procurement controls.

nis2.scope_review

NIS2 scope review

Scope applicability, evidence gaps, governance, supplier controls, or implementation work.

document.compliance_review

Document review

Request structured feedback on a policy, risk register, procedure, control set, or governance document.

training.request

Training and workshops

Request a talk, tabletop exercise, workshop, webinar, or role-specific learning activity.

consulting.intake

General consulting intake

Use when the need crosses several domains and the first task is to define the engagement.

meeting.request

Meeting request

Request a human conversation when a structured API response is not the right next step.

Minimum handoff

One authorized request. One stable key.

Use the current schema before constructing a request. Every logical request needs an Idempotency-Key. Reuse the key only to retry the identical payload.

  1. 01
    Discover

    Read capabilities and the OpenAPI schema.

  2. 02
    Confirm authority

    Name the principal and the exact scope they authorized.

  3. 03
    Submit

    Send a narrow request without secrets or sensitive data.

  4. 04
    Wait for human follow-up

    Keep the request ID. SPADE replies manually to the principal by email.

POST /api/agent/requestsschema ↗
curl -X POST \
  https://api.spadeconsulting.no/api/agent/requests \
  -H 'Content-Type: application/json' \
  -H 'Idempotency-Key: example-as-ai-review-001' \
  -d '{
    "capability": "ai_act.classification_review",
    "principal": {
      "name": "Example AS",
      "email": "[email protected]"
    },
    "requester": {
      "type": "agent",
      "name": "Governance agent"
    },
    "authorization": {
      "confirmed": true,
      "scope": "Request a proposal for one use case"
    },
    "summary": "Human-reviewed classification requested.",
    "dataClassification": "public",
    "desiredOutcome": "proposal"
  }'
Safety boundary

Intake is not authority to act

Never include

  • Passwords, API keys, or authentication tokens
  • Special-category personal data
  • Unapproved customer or employee information
  • Confidential material without a separate agreement

API acceptance means

  • Resend accepted an email to SPADE's private inbox
  • SPADE may verify the principal and scope manually
  • SPADE may ask for clarification or decline
  • No client relationship exists yet

Human confirmation controls

  • Commercial terms and final scope
  • Access to non-public information
  • Actions in customer systems
  • Professional conclusions and delivery
Machine-readable resources

Choose the lightest interface that works.

Need a human before the API?

Send a short description of the principal, authority, problem, and desired outcome through the protected contact form. Do not include sensitive information.