agent-policy-engine

Safety guardrails for tool-using AI agents — evaluate every tool call as allow / deny / quarantine.

Autonomous, tool-using LLM agents can spend real money, run shell commands, modify their own files, and act on untrusted input. agent-policy-engine puts a deterministic checkpoint in front of every tool call: spend limits, allowlists, command-safety checks, path protection, rate limits, and prompt-injection defense via authority levels — with three outcomes instead of two.

Why three outcomes matter

• allow — the call is safe; execute it.
• deny — a hard limit was hit; block it. First deny wins and short-circuits evaluation.
• quarantine — high-value or ambiguous; pause for human confirmation instead of silently blocking or blindly running.

What it guards

• Spend limits — per-transfer caps, hourly/daily rolling windows, per-turn counts, inference budgets.
• Allowlists — payment/x402 domains must be explicitly allowlisted; empty allowlist = deny-by-default.
• Command safety — shell-injection detection and forbidden-command patterns.
• Path protection — deny writes to protected files, reads of secrets, and path-traversal escapes.
• Authority levels — untrusted input is derived to low authority and blocked from destructive tools.

Quick start

import { PolicyEngine, createDefaultRules, SpendTracker } from "agent-policy-engine";

const engine = new PolicyEngine(createDefaultRules());
const sessionSpend = new SpendTracker();

const decision = engine.evaluate({
  tool: { name: "transfer_credits", category: "financial", riskLevel: "dangerous" },
  args: { to_address: "0x1234...7890", amount_cents: 6000 },
  turnContext: { inputSource: "agent", turnToolCallCount: 0, sessionSpend },
});

if (decision.action === "deny") throw new Error(decision.humanMessage);
if (decision.action === "quarantine") await confirmWithHuman(decision);
// else: allow → execute the tool, then sessionSpend.recordSpend(...)

Install

npm i github:Princeu3/agent-policy-engine

npm registry release coming soon.