Roll out enforcement by watching 422s

Resolving from anywhereHTTPMCPDashboardenforce_schemacheck_resolutionPATCH /api/roles/:role

Turn on schema enforcement for one role and let each 422 name the submitter and the exact fields it is missing.

The situation

A role has been resolved for months by the dashboard, two services and an agent. You want the server to enforce its form, without breaking whichever client sends incomplete payloads.

The recipe

Opt one role in

curl -X PATCH https://lt.acme.dev/api/roles/intake-reviewer \
  -H "Authorization: Bearer $TOKEN" -H 'Content-Type: application/json' \
  -d '{ "enforce_schema": true }'

1. Confirm submitters send complete payloads. check_resolution gives an agent the fields, types and bind paths it needs.
2. Set enforce_schema: true on the role, through the API, the update_role MCP tool or the role editor.
3. Watch for 422s. Each one names a submitter with a gap and the exact fields.

The dashboard is unaffected: its pre-submit check is the same code as the server gate.

The guarantee

Enforcement is per role and opt-in. The schema checked is the most specific one for the row: an embedded metadata.form_schema, else the pinned version, else the role’s latest. The set of enforcing roles is cached (30 seconds by default), so a resolve on a role that does not enforce adds no query. See Schema enforcement.

Related patterns

Resolving from anywhere

One contract, one 422

Every resolve surface rejects a bad payload with the same 422 body naming each field, so every client handles validation one way.

enforce_schemaschema_validationDashboardHTTPSDK

Resolving from anywhere

Validate before claiming

An agent's claim-and-resolve validates the payload first, so a rejected answer never leaves a row locked to the agent.

claim_and_resolvecheck_resolutionMCPHTTP

Forms and configuration

Code-owned configuration

Set configSource to code and every declared role, workflow, topic, agent and scan scheme is diffed and applied on each boot from git.

configSourceresetSDK