Hand off a conversation and use Ask

For: people running and reviewing agents.

Handing a conversation to another agent

An agent continues its own conversations. To let it continue another agent's, its manifest says so:

name: booking
runtime: pydantic-ai
input: text
conversation:
  continue_from: [weather]   # or ["*"] for any agent of the tenant

oz0 run booking --conversation conv-5e1d… "Book the warmer one" then hands the conversation over; in the chat drawer, Hand over offers the agents that may (ListStartable with continues). Without it the turn is refused: agent booking may not continue a conversation of agent weather.

Ask: one chat that finds the right agent

Ask is the platform's built-in agent (oz.ask), at the top of the chat picker. Tell it what you need: it lists the agents you may start, and hands the chat to the one that fits, or asks one of them a one-off question and answers in the chat. No plugin installs it; every node runs it.

How it chooses. Ask reads the agents' names and descriptions, as ListStartable lists them for you (the operator role, kill switches applied), and picks one with a model call. Write your agents' description well: it is all Ask goes by, and in a tenant of thousands of agents Ask finds one by the words of its name and description, so put the words people use in them. It has exactly three tools, all built in:

Searching for an agent

oz.list_startable returns the agents you may start now, with their descriptions and whether a chat can be handed to them. It leaves out Ask itself and flows. It takes a query of a few words from your request and answers at most 25 agents, the best matches first, and how many matched; Ask searches again with other words when the one it needs is not among them.

A query keeps its first 8 words. A node whose runtime predates the search gets the list as before, every agent up to 1,000, until it updates.

What it cannot do. Ask can never reach an agent you could not start yourself: the edge, not the model, checks each list, delegation and hand-over against what you may do at that moment, and the hand-over starts the next turn as you, so your quotas, the target's budget and kill switches, its input contract and your chat's privacy all apply. The agent it hands to gets your words, never a message the model wrote.

Descriptions are written by plugin authors, so they may try to steer Ask (prompt injection): at worst Ask picks another agent you may start, and every step the edge refuses is in the audit log as ask.refused. Ask has no other tools, writes nothing, and its answers carry the tenant's AI label.

Any agent that takes part in conversations may take a chat over from Ask; its manifest need not list oz.ask in continue_from. Nothing but Ask continues into Ask.

Its model is yours. Ask runs on one of the tenant's model aliases: the one named default, or another an admin names. Without that alias Ask is not offered, and the picker works as before; no vendor's model is ever picked for you.

oz0 model alias set default anthropic/claude-haiku-4-5   # Ask is offered from now on
oz0 tenant ask default                    # show: on or off, its alias, and why it is not offered
oz0 tenant ask default off                # admins; audited as tenant.ask
oz0 tenant ask default on --model smart   # another alias

Its cost and trace. An Ask turn is a job like any other: its model calls are metered to it, and its trace shows them with their cost, beside the routing steps: the list it saw, a check before each delegation, and the hand-over with the job it started. The next turn's trace links back to the Ask turn. A kill switch on oz.ask stops it, and the tenant's budgets and quotas cover it.

Narrowing it. The tenant's tool policy narrows Ask's tools with rules whose match starts with oz.: oz0 policy ask oz.hand_over asks a person before each hand-over, and oz0 policy refuse oz.delegate leaves Ask only hand-overs. Broad rules over plugins' tools (*, by kind or by caller) do not reach Ask's built-ins.