Anatomy of a config

station: {...}        # STATION — what it is: id, kind (product | process), guidance, delegation,
                      #   and its identity providers (`station.identity.providers`)
global: {...}         #   what applies everywhere: language, currency, time zone
texts: {...}          #   Convoy's refusal and hold sentences, rewritten per language

apis: [...]           # SOURCES — the tools, and for each operation: read or write, risk

                      # CONTEXT — rooms and sessions: the platform holds them, no key

profiles: {...}       # AUTH — WHO acts: visitor, verified customer, company agent, manager

policies: {...}       # POLICIES — reusable: rule (deterministic, budgets included)
                      #   or smart (a model and a threshold), cited everywhere
inboxes: {...}        #   where a PERSON is called to decide, and within what delay

skills: [...]         # CAPABILITIES — the skills: invoke, kinds, present, select, submit
playbooks: [...]      #   the journeys: tasks, their order, their submit
events: {...}         #   inbound (facts received), emits (the ones it publishes), outbound
automations: [...]    #   when an event arrives, if a condition holds, then start

tests: [...]          # VERIFY — TEST THE STATION: the promised behaviours, no model,
                      #   replayed before every release to production

agent: {...}          # AGENT — the agent Convoy deploys, a client of the station like any other,
                      #   and its portals (web, Teams, Slack, WhatsApp)
evals: [...]          #   TEST THE AGENT: what it does with a request, measured over several runs

The map of the guide

	page	what you set there
1	Anatomy	the shape of the file
2	Station	station, global, texts
3	Sources	apis: APIs and integrations
4	Context	what the platform holds for you: rooms, sessions, selection, history
5	Auth	identity, profiles
6	Policies	policies, guards, permissions, inboxes, data, budgets
7	Capabilities	skills, playbooks, events, automations, and the policies possible on each
8	Agent and portals	agent
9	Verify and publish	tests, evals, release to production

Three scopes in one file

• global applies everywhere: the currency in global is the currency of all fields of type price, the language is that of every answer.
• The station — from station to tests — holds for every agent: Claude, ChatGPT, a company's agent, and ours. A rule that every agent must respect is written here: it is a policy.
• agent describes our agent: its voice, its instructions, its portals. It consumes the station through the same door and under the same rules as the others. Its evals go with it: they test our agent, not the station. See The agent and its portals and Verify and publish.

There is no storefront block: the station is not a shop, and a tenant's site is only one of its agent's portals.

Everything is optional except station, global, apis and skills. Without agent, the station can only be reached by other people's agents, over MCP. A station that declares no profiles, no policies and no playbooks behaves as today: a human submits, no model.

The rules of the file

• Every key is read, every reference checked at load time. See Verify and publish.
• Everything is closed by default: a tenant operation is called only for the profiles that received it in grants.
• What sits below the station can only tighten: a skill, a playbook, a task, a profile, a sub-identity add rules; they never remove any. Only grants open.
• References name things in the config, never the tenant's operations: $read[facture] (a task), $submitted[geste.pay] (a task and the named call of its skill), $submitted[order] (a call of the playbook). A rename on the tenant's side breaks nothing.

The writing order

station and global → apis → skills → playbooks → profiles and policies → events and automations → tests → agent. You first write what the station can do, then who is allowed to do it.