agentpolicy

package module

Go to main page

Versions in this module

v0

v0.0.11

Oct 2, 2026

Changes in this version

+ func ContextWithGrantScope(ctx context.Context, scope string) context.Context

+ func GrantScopeFromContext(ctx context.Context) string

type Engine

+ func (e *Engine) GrantsFor(ctx context.Context) []RuleSet

+ func (e *Engine) RevokeScope(ctx context.Context) int

+ func (e *Engine) Would(ctx context.Context, info agentturn.ToolCallInfo) (Verdict, error)

type Option

+ func WithToolsFor(lookup func(ctx context.Context, name string) (agenttool.Tool, bool)) Option

type Policy

+ func (p Policy) WithDefault(d Default) Policy

v0.0.10

Oct 1, 2026

v0.0.9

Oct 1, 2026

v0.0.8

Sep 30, 2026

v0.0.7

Sep 29, 2026

Changes in this version

type Option

+ func WithHooks(...) Option

+ func WithNeverStarted(fn func(ctx context.Context, runID, callID string) bool) Option

v0.0.6

Sep 29, 2026

v0.0.5

Sep 29, 2026

Changes in this version

+ const VerdictNS

type Matcher

+ func GlobMatcher(field string) Matcher

type Option

+ func WithConfinement(...) Option

+ func WithTools(lookup func(name string) (agenttool.Tool, bool)) Option

type Rule

+ Note string

type Verdict

+ Confined string

+ func (v Verdict) Record() (ns string, data []byte)

v0.0.4

Sep 28, 2026

v0.0.3

Sep 24, 2026

Changes in this version

+ const ByAgent

+ const ByHuman

+ const ByPolicy

+ var ErrToolGlob = errors.New("agentpolicy: tool-name glob")

+ var ErrUnanswered = errors.New("agentpolicy: pending call has no answer")

type Engine

+ func (e *Engine) Filter(tools []agenttool.Tool) []agenttool.Tool

+ func (e *Engine) Forget(runID string)

+ func (e *Engine) GrantSet(ctx context.Context, set RuleSet) (granted []Rule, refused []Refusal)

+ func (e *Engine) Grants() []RuleSet

+ func (e *Engine) PolicyOf(source string) RuleSet

+ func (e *Engine) Removes(tool string) (Rule, bool)

+ func (e *Engine) Revoke(ctx context.Context, source string) int

+ func (e *Engine) Runs() []string

+ func (e *Engine) SetPolicy(p Policy) error

+ func (e *Engine) ToolProvider(base func(context.Context) []agenttool.Tool) func(context.Context) []agenttool.Tool

+ func (e *Engine) Withheld() []Rule

type Option

+ func WithAliases(aliases map[string][]string) Option

type Policy

+ Withheld []Rule

+ type Refusal struct

+ Reason string

+ Rule Rule

type Review

+ By string

type Rule

+ func (r Rule) Glob() bool

+ func (r Rule) MatchesTool(tool string) bool

type Verdict

+ By string

+ Subject string

v0.0.2

Sep 21, 2026

Changes in this version

type Engine

+ func (e *Engine) Deferred(callID string) (Verdict, bool)

+ func (e *Engine) Release(ctx context.Context, end *agentturn.RunEnd, answers ...agentturn.Answer) []agentturn.Answer

type Review

+ Note string

type Verdict

+ Held bool

v0.0.1

Sep 20, 2026

Changes in this version

+ var DefaultDenialBound = DenialBound

+ var ErrDenialBound = errors.New("agentpolicy: reviewer denial bound reached")

+ var ErrNoDefault = errors.New("agentpolicy: policy default is not set; use Allow(), Deny() or Ask()")

+ var ErrNoMatcher = errors.New("agentpolicy: no matcher for the rule's tool")

+ type Default struct

+ func Allow() Default

+ func Ask() Default

+ func Deny() Default

+ func (d Default) Action() (agentturn.ToolAction, bool)

+ func (d Default) String() string

+ type DenialBound struct

+ Consecutive int

+ Total int

+ Window int

+ type Engine struct

+ func Build(p Policy, matchers map[string]ToolMatcher, opts ...Option) (*Engine, error)

+ func (e *Engine) Answers(ctx context.Context, r Reviewer, end *agentturn.RunEnd) ([]agentturn.Answer, error)

+ func (e *Engine) BeforeToolCall() func(context.Context, agentturn.ToolCallInfo) (*agentturn.ToolDecision, error)

+ func (e *Engine) Decide(ctx context.Context, info agentturn.ToolCallInfo) (*agentturn.ToolDecision, error)

+ func (e *Engine) Grant(ctx context.Context, r Rule) error

+ func (e *Engine) GrantOver(ctx context.Context, v Verdict, r Rule) (granted bool, reason string)

+ func (e *Engine) Policy() Policy

+ func (e *Engine) ResetReviews()

+ func (e *Engine) Sources() []Source

+ type Matcher func(spec string, args json.RawMessage) bool

+ func PrefixMatcher(field string) Matcher

+ type Option func(*Engine)

+ func WithDenialBound(b DenialBound) Option

+ func WithObserver(fn func(context.Context, Verdict)) Option

+ type Outcome int

+ const Approved

+ const Refused

+ const TimedOut

+ func (o Outcome) String() string

+ type Policy struct

+ Allow []Rule

+ Ask []Rule

+ Default Default

+ Deny []Rule

+ Sources []Source

+ func AutoEdit(t Tools) Policy

+ func FullAuto(t Tools) Policy

+ func Merge(sets ...RuleSet) (Policy, error)

+ func Suggest(t Tools) Policy

+ type Review struct

+ Args json.RawMessage

+ Outcome Outcome

+ Reason string

+ type Reviewer interface

+ Review func(ctx context.Context, info agentturn.ToolCallInfo, v Verdict) (Review, error)

+ type ReviewerFunc func(context.Context, agentturn.ToolCallInfo, Verdict) (Review, error)

+ func (f ReviewerFunc) Review(ctx context.Context, info agentturn.ToolCallInfo, v Verdict) (Review, error)

+ type Rule struct

+ Source Source

+ Spec string

+ Tool string

+ func ParseRules(s string) ([]Rule, error)

+ func (r Rule) Bare() bool

+ func (r Rule) CarveOut() (pattern string, ok bool)

+ func (r Rule) String() string

+ type RuleSet struct

+ Allow []Rule

+ Ask []Rule

+ Deny []Rule

+ Source Source

+ type Source struct

+ Hash string

+ Name string

+ Path string

+ Rank int

+ Trusted bool

+ type Subject struct

+ Args json.RawMessage

+ Text string

+ Tool string

+ type Subjects func(args json.RawMessage) ([]Subject, error)

+ type ToolMatcher struct

+ Match Matcher

+ Subjects Subjects

+ type Tools struct

+ Edit []string

+ Execute []string

+ Read []string

+ type Verdict struct

+ Action agentturn.ToolAction

+ CallID string

+ Guard string

+ Reason string

+ Rule *Rule

+ RunID string

+ Tool string

+ Turn int

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL