For AI agents and human-agent teams

Norsk introduksjon

Åpen for agent-initierte oppdrag, med menneskelig ansvar

Agenter kan finne relevante tjenester og sende en strukturert forespørsel til SPADEs private innboks. En navngitt person eller virksomhet må ha autorisert henvendelsen, og ingen API-innsending starter fakturerbart arbeid eller gir tilgang til kundesystemer.

Dette passer blant annet for innkjøpsagenter, styringsagenter, sikkerhetsarbeidsflyter og team der mennesker og agenter deler analyse- og dokumentasjonsarbeid.

Requestable capabilities

A precise catalog, not an open-ended promise

These identifiers are canonical API values. Availability means a request may enter review—not that the work is automatically accepted.

security.risk_review

Security and risk review

Scope a risk assessment, architecture review, ISO 27001 activity, or practical security decision.

privacy.dpia_triage

DPIA triage

Determine whether a processing activity needs deeper privacy assessment and what evidence is missing.

privacy.vendor_review

Vendor and processor review

Review privacy, security, contractual, and data-flow questions around a supplier.

ai_act.classification_review

AI Act classification review

Request a human-reviewed assessment of roles, use case, risk category, and documentation needs.

ai_governance.policy_review

AI governance and policy

Review AI policy, inventory, decision rights, human oversight, or procurement controls.

nis2.scope_review

NIS2 scope review

Scope applicability, evidence gaps, governance, supplier controls, or implementation work.

document.compliance_review

Document review

Request structured feedback on a policy, risk register, procedure, control set, or governance document.

training.request

Training and workshops

Request a talk, tabletop exercise, workshop, webinar, or role-specific learning activity.

consulting.intake

General consulting intake

Use when the need crosses several domains and the first task is to define the engagement.

meeting.request

Meeting request

Request a human conversation when a structured API response is not the right next step.

Minimum handoff

One authorized request. One stable key.

Use the current schema before constructing a request. Every logical request needs an Idempotency-Key. Reuse the key only to retry the identical payload.

01
Discover
Read capabilities and the OpenAPI schema.
02
Confirm authority
Name the principal and the exact scope they authorized.
03
Submit
Send a narrow request without secrets or sensitive data.
04
Wait for human follow-up
Keep the request ID. SPADE replies manually to the principal by email.

POST /api/agent/requestsschema ↗

curl -X POST \
  https://api.spadeconsulting.no/api/agent/requests \
  -H 'Content-Type: application/json' \
  -H 'Idempotency-Key: example-as-ai-review-001' \
  -d '{
    "capability": "ai_act.classification_review",
    "principal": {
      "name": "Example AS",
      "email": "owner@example.no"
    },
    "requester": {
      "type": "agent",
      "name": "Governance agent"
    },
    "authorization": {
      "confirmed": true,
      "scope": "Request a proposal for one use case"
    },
    "summary": "Human-reviewed classification requested.",
    "dataClassification": "public",
    "desiredOutcome": "proposal"
  }'

Safety boundary

Intake is not authority to act

Never include

Passwords, API keys, or authentication tokens
Special-category personal data
Unapproved customer or employee information
Confidential material without a separate agreement

API acceptance means

Resend accepted an email to SPADE's private inbox
SPADE may verify the principal and scope manually
SPADE may ask for clarification or decline
No client relationship exists yet

Human confirmation controls

Commercial terms and final scope
Access to non-public information
Actions in customer systems
Professional conclusions and delivery

Agent-ready expertise

Use a focused workflow, not an article dump

These public skills turn SPADE's article archive into evidence-led assessment workflows. Each package separates facts from assumptions, requires current primary-source verification, and identifies when human review is needed.

assess-ai-governance

Choose the lightest interface that works.

Need a human before the API?

Send a short description of the principal, authority, problem, and desired outcome through the protected contact form. Do not include sensitive information.

Professional services with a clear machine handoff.