Draft until it meets the rubric

This recipe turns one request into a draft that meets a rubric. A webhook brings the goal and the rubric, the Writer Agent drafts, a Model block scores the draft from 1 to 10, and a score under 8 sends the draft and the reviewer’s reason back to the Writer. After 3 drafts the run ends as not passed.

request (webhook) → draft (Writer Agent) → grade (score, pass at 8)
                         ↑                      │ fail, up to 3 times
                         └──────────────────────┘

The Checkfu CLI and TypeScript SDK are private-alpha artifacts with no self-service public installation channel. Part of this flow is behind a rollout fence; a deployment that has not enabled it refuses the request rather than running it. Confirm capability status before making availability part of your application’s contract.

Before you start

You need:

An API key with the admin or root role in CHECKFU_API_KEY.
A service account for the Automation to run as (RUNS_AS, a prin_…), and the person who authors it (AUTHOR, a prin_…). An API key is not a person, so a create through an API key names the author.
The Writer Agent (WRITER_AGENT).
The Environment the Agent runs in (ENVIRONMENT). When the Workspace has exactly one, delete the environment_id line and leave out ENVIRONMENT.
A model routing profile with the key fast-judge, or change route.profile to one you have.

export RUNS_AS=prin_0123456789abcdef0123456789abcdef
export AUTHOR=prin_fedcba9876543210fedcba9876543210
export WRITER_AGENT=agent_0123456789abcdef0123456789abcdef
export ENVIRONMENT=env_0123456789abcdef0123456789abcdef

The CLI examples use CLI access and the TypeScript examples use the TypeScript SDK.

Create the draft

Save the recipe as outcomes.yaml. It is the published outcomes.yaml with created_by_principal_id added:

outcomes.yaml

# yaml-language-server: $schema=https://docs.checkfu.com/openapi.json#/components/schemas/CreateBlockAutomation
name: Draft until it meets the rubric
runs_as: "${RUNS_AS}"
environment_id: "${ENVIRONMENT}"
created_by_principal_id: "${AUTHOR}"
blocks:
  - id: request
    type: trigger
    trigger: { type: webhook, dedupe_pointer: /id }
  - id: draft
    type: agent
    agent: "${WRITER_AGENT}"
    prompt: |
      {{request.goal}}
      Your previous draft (empty on the first try): {{draft.output}}
      Reviewer feedback (empty on the first try): {{grade.reason}}
  - id: grade
    type: model
    route: { profile: fast-judge }
    prompt: "Score this draft against the rubric. Rubric: {{request.rubric}} Draft: {{draft.output}}"
    format: { type: score, levels: 10, pass_at: 8 }
wires:
  - { from: request, to: draft }
  - { from: draft, to: grade }
  - { from: grade, port: fail, to: draft, max_attempts: 3 }

The draft is saved paused and unpublished.

checkfu automations validate -f outcomes.yaml --var RUNS_AS=$RUNS_AS --var AUTHOR=$AUTHOR \
  --var WRITER_AGENT=$WRITER_AGENT --var ENVIRONMENT=$ENVIRONMENT
checkfu automations create -f outcomes.yaml --var RUNS_AS=$RUNS_AS --var AUTHOR=$AUTHOR \
  --var WRITER_AGENT=$WRITER_AGENT --var ENVIRONMENT=$ENVIRONMENT

curl --request POST https://api.checkfu.com/v1/automations \
  --header "Authorization: Bearer $CHECKFU_API_KEY" \
  --header "Checkfu-Version: 2026-08-31" \
  --header "Idempotency-Key: $(uuidgen)" \
  --header "Content-Type: application/json" \
  --data '{
    "name": "Draft until it meets the rubric",
    "runs_as": "'"$RUNS_AS"'",
    "created_by_principal_id": "'"$AUTHOR"'",
    "environment_id": "'"$ENVIRONMENT"'",
    "blocks": [
      { "id": "request", "type": "trigger", "trigger": { "type": "webhook", "dedupe_pointer": "/id" } },
      {
        "id": "draft",
        "type": "agent",
        "agent": "'"$WRITER_AGENT"'",
        "prompt": "{{request.goal}}\nYour previous draft (empty on the first try): {{draft.output}}\nReviewer feedback (empty on the first try): {{grade.reason}}\n"
      },
      {
        "id": "grade",
        "type": "model",
        "route": { "profile": "fast-judge" },
        "prompt": "Score this draft against the rubric. Rubric: {{request.rubric}} Draft: {{draft.output}}",
        "format": { "type": "score", "levels": 10, "pass_at": 8 }
      }
    ],
    "wires": [
      { "from": "request", "to": "draft" },
      { "from": "draft", "to": "grade" },
      { "from": "grade", "port": "fail", "to": "draft", "max_attempts": 3 }
    ]
  }'

import { Checkfu, recipes } from "@checkfu/sdk"

const checkfu = new Checkfu({ apiKey: process.env.CHECKFU_API_KEY })

const document = recipes.outcomes({
  runsAs: process.env.RUNS_AS!,
  environmentId: process.env.ENVIRONMENT,
  agent: process.env.WRITER_AGENT!,
  route: { profile: "fast-judge" },
  maxAttempts: 3,
})

const automation = await checkfu.automations.create(
  {
    ...document,
    created_by_principal_id: process.env.AUTHOR,
  },
  { idempotencyKey: crypto.randomUUID() },
)

Keep the auto_… id it returns:

export AUTOMATION=auto_0123456789abcdef0123456789abcdef

Grant what it needs

The service account needs act_as on the Writer and use_model on the route. List what the draft needs and what is missing:

curl https://api.checkfu.com/v1/automations/$AUTOMATION/access \
  --header "Authorization: Bearer $CHECKFU_API_KEY" \
  --header "Checkfu-Version: 2026-08-31"

Each entry has a status of granted or missing, the blocks that need it and a plain message. Grant a missing one with a PermissionAssignment:

curl --request POST https://api.checkfu.com/v1/permission-assignments \
  --header "Authorization: Bearer $CHECKFU_API_KEY" \
  --header "Checkfu-Version: 2026-08-31" \
  --header "Idempotency-Key: $(uuidgen)" \
  --header "Content-Type: application/json" \
  --data '{
    "subject": { "type": "principal", "id": "'"$RUNS_AS"'" },
    "resource": { "type": "agent", "id": "'"$WRITER_AGENT"'" },
    "permission": "act_as"
  }'

A grant that already exists answers 409.

Test the draft

A test is a real run of the draft with a sample request. It starts real Sessions and lists them as its effects, but registers no trigger.

checkfu automations test $AUTOMATION \
  --event '{"id":"req-1","goal":"Write a two-line release note for v2.","rubric":"Names the version and fits in two lines."}'
checkfu automations trace afire_0123456789abcdef0123456789abcdef

curl --request POST https://api.checkfu.com/v1/automations/$AUTOMATION/test \
  --header "Authorization: Bearer $CHECKFU_API_KEY" \
  --header "Checkfu-Version: 2026-08-31" \
  --header "Content-Type: application/json" \
  --data '{
    "event": {
      "id": "req-1",
      "goal": "Write a two-line release note for v2.",
      "rubric": "Names the version and fits in two lines."
    }
  }'

const test = await checkfu.automations.test(automation.id, {
  event: {
    id: "req-1",
    goal: "Write a two-line release note for v2.",
    rubric: "Names the version and fits in two lines.",
  },
})
console.log(test.run.id, test.effects.map((effect) => effect.description))

Publish

Publishing makes the draft the live version and returns the webhook URL and its signing secret. The secret is shown once; store it where your sender can sign with it.

checkfu automations publish $AUTOMATION

curl --request POST https://api.checkfu.com/v1/automations/$AUTOMATION/publish \
  --header "Authorization: Bearer $CHECKFU_API_KEY" \
  --header "Checkfu-Version: 2026-08-31" \
  --header "Content-Type: application/json" \
  --data '{}'

const publication = await checkfu.automations.publish(automation.id, {})
console.log(publication.summary, publication.webhook_secret)

The summary says what publishing did, for example “Listens for signed webhooks at POST /v1/ingest/automations/auto_…”. Rotate the secret with POST /v1/automations/{id}/webhook-secret.

Run it and read the result

A signed webhook starts a run. You can also run the live version now with the same request:

checkfu automations run $AUTOMATION \
  --event '{"id":"req-2","goal":"Write a two-line release note for v2.","rubric":"Names the version and fits in two lines."}'

curl --request POST https://api.checkfu.com/v1/automations/$AUTOMATION/run \
  --header "Authorization: Bearer $CHECKFU_API_KEY" \
  --header "Checkfu-Version: 2026-08-31" \
  --header "Idempotency-Key: $(uuidgen)" \
  --header "Content-Type: application/json" \
  --data '{
    "event": {
      "id": "req-2",
      "goal": "Write a two-line release note for v2.",
      "rubric": "Names the version and fits in two lines."
    }
  }'

const run = await checkfu.automations.run(
  automation.id,
  {
    event: {
      id: "req-2",
      goal: "Write a two-line release note for v2.",
      rubric: "Names the version and fits in two lines.",
    },
  },
  { idempotencyKey: crypto.randomUUID() },
)

List the runs and their status:

checkfu automations runs $AUTOMATION --limit 5

curl "https://api.checkfu.com/v1/automation-runs?automation_id=$AUTOMATION&limit=5" \
  --header "Authorization: Bearer $CHECKFU_API_KEY" \
  --header "Checkfu-Version: 2026-08-31"

const runs = await checkfu.automationRuns.list({ automation_id: automation.id, limit: 5 })

A run that passed ends completed. A run whose third draft still failed ends as not passed, and the automation_run.completed webhook event carries result: "not_passed".

Pause and resume

Pause stops webhooks from starting runs; a manual run still works. Resume turns triggers back on.

checkfu automations pause $AUTOMATION

curl --request POST https://api.checkfu.com/v1/automations/$AUTOMATION/pause \
  --header "Authorization: Bearer $CHECKFU_API_KEY" \
  --header "Checkfu-Version: 2026-08-31" \
  --header "Content-Type: application/json" \
  --data '{}'

await checkfu.automations.pause(automation.id, {})

checkfu automations resume $AUTOMATION

curl --request POST https://api.checkfu.com/v1/automations/$AUTOMATION/resume \
  --header "Authorization: Bearer $CHECKFU_API_KEY" \
  --header "Checkfu-Version: 2026-08-31" \
  --header "Content-Type: application/json" \
  --data '{}'

await checkfu.automations.resume(automation.id, {})

Change it

Edit the document and replace the draft with PATCH /v1/automations/{id} and its expected_draft_revision, then test and publish again. Each run records the version it used, and checkfu automations versions $AUTOMATION lists them. See Automations for every block and field.

Get started

Agents

Environments

Context

Tools

Permissions

Automations

Sessions

Security & Billing

Draft until it meets the rubric

Before you start

Create the draft

Grant what it needs

Test the draft

Publish

Run it and read the result

Pause and resume

Change it

​Before you start

Create the draft

Grant what it needs

Test the draft

Publish

Run it and read the result

​Pause and resume

​Change it

Before you start

Pause and resume

Change it