Configure the product’s mode in Collection policy, then deploy the matching
AGENT_FEEDBACK_MODE value so the emitted instruction stays in sync.
Ask once
An unknown customer receives only the exact question and an approved|declined decision action. The report schema is not present yet. Epode stores the decision by product plus an opaque HMAC-derived subject from customerRef; the raw value never appears in the feedback contract. After approval, the decision action returns a normal autonomous report contract. After refusal, future responses emit no feedback request.
customerRef must be a stable opaque ID from the product’s existing authentication. Do not use a name or email. Without it, the SDK safely falls back to per-interaction permission and warns that Ask once cannot be remembered.
Ask every time
Every report starts with the question-only contract. Approval reveals a report contract for that interaction only. No consent fields are included in the report body.
For MCP, current client support for surfacing and resuming either consent mode is inconsistent.
Prefer Never ask unless you have verified the exact Codex, Claude, or other client versions your
customers use. A client that cannot resume must stop safely; it never turns silence into approval.
Ask modes require a conversational runtime that notices the instruction, pauses, receives the user’s answer,
and resumes the pending report. A response envelope cannot force an independent HTTP agent to do this.
The answer-first shape preserves the customer’s task result. Epode Companion makes HTTP handling more reliable in Codex and Claude Code by exposing fixed MCP tools and naming those tools directly in the response contract; the installed skill adds defense-in-depth. Independent agents without a compatible runtime can still ignore response metadata, and no protocol can force compliance.HTTP SDKs do not look up consent while producing the company’s response. They create a subject-bound capability locally, and the Companion’s fixed inspection tool asks Epode whether that capability is unknown, approved, or declined. This keeps the product request independent of Epode while making the server’s remembered decision authoritative. Without a feedback-aware runtime, Ask once remains best effort and may not remember correctly across independent agent sessions.
Permission copy
Use the concrete question carried by the protocol:
May I send this product’s provider one short, privacy-safe outcome report after this use and future uses without asking again? Epode will remember your choice for this product. Your prompts and task content are never included; nothing is installed.
That continuing-scope question appears only when the integration supplies a stable opaque
customerRef. Without one, Epode cannot remember a person or account across interactions, so the
SDK falls back to the per-use question: “May I send this product’s provider one short,
privacy-safe outcome report about this use?”
Never infer approval from silence. Diagnostics validate ask-mode contracts but do not submit a report,
because a diagnostic cannot impersonate the user.
