Steering

Use steering to guide an investigation, explore a promising result, or ask questions about the work an agent has done. Messages stay in the run’s conversation, so the agent can respond using its investigation history and evidence. Call run.steer() to send a message during a run or continue the conversation after the agent finishes its task.

Guide an investigation

As you follow a run, you may notice an area that deserves more attention. Give the agent a specific direction to explore:

await run.steer(
  "The account API returned different responses for those two users. Investigate whether that difference exposes another account's data.",
);

You can also share context that changes its priorities:

await run.steer(
  "We deployed a new GraphQL schema today. Spend more time checking authorization in its mutations.",
);

The agent uses your message alongside the task, skills, and guardrails to decide how to proceed.

Explore further

When the agent identifies a weakness or leaves a question unresolved, you can ask it to investigate further.

await run.steer(
  "You confirmed the issue on the export endpoint. Check whether the same authorization behavior affects downloads.",
);

Describe the observation and what you want to learn next. This helps the agent pursue a concrete lead and build on the evidence it already collected. Further testing stays within the run’s approved scope.

Ask questions after testing

You can continue the conversation after the agent finishes testing. Ask it to explain a vulnerability, discuss the evidence, or clarify what it tested:

await run.wait();

await run.steer(
  "Did you test whether a read-only user could access the export endpoint? Explain what you tried and what the responses showed.",
);

for await (const event of run) {
  console.log(event.type, event.summary);
}

The agent answers using the context from that run. You can ask follow-up questions or give it additional work in the same conversation.

Use steering for triage and remediation

Steering also works with agents investigating vulnerabilities or preparing fixes. You can explain a repository convention, question a proposed change, or ask the agent to consider another approach:

await run.steer(
  "Older clients depend on this response format. Can you address the authorization issue while preserving it?",
);

Steering messages apply to the current run. To reuse instructions across future runs, add them to the agent’s skills or guardrails.

Getting started

Asset Map

Runs

Vulnerability Lifecycle

Team Workflows

SDK

CLI

Integrations

Guide an investigation

Explore further

Ask questions after testing

Use steering for triage and remediation

​Guide an investigation

​Explore further

​Ask questions after testing

​Use steering for triage and remediation

Guide an investigation

Explore further

Ask questions after testing

Use steering for triage and remediation