A Policy Kernel, Not a Prompt

Описание и применение

Кернел политики Garu ограничивает действия автономного агента, скрывая запрещённые инструменты и требуя подтверждения для неопределённых вызовов, обеспечивая безопасную работу ночью.

Задача

An always‑on agent with access to email, files, and repositories must be restricted to prevent unintended actions.

Результат

By moving policy enforcement into a kernel and hiding disallowed tools, the author achieved a safe unattended agent that only performs approved actions and logs all decisions.

Рабочий процесс

• Define a YAML policy file listing allowed, asked, or blocked tools and argument conditions.
• Deploy the policy kernel with the agent; the kernel intercepts every tool call.
• The kernel evaluates rules top‑to‑bottom; the first match decides the action.
• If no rule matches, the kernel presents an ask card and waits up to 30 min for a response.
• Unanswered asks default to denial.
• Record every decision for audit and replay.
• Run each tool server in a sandbox container for isolation.
• Iterate policy rules to refine allowed actions.
• Test by simulating overnight runs to confirm safety.
• Publish the policy and kernel as open source under Apache‑2.0.

Доказательства

An agent that runs all night with access to my email, my files and my repositories has to answer one question before anything else: what exactly can it touch?

Источник

The kernel reads the list top to bottom, and the first rule that matches decides.

Источник

If no rule matches a call, the kernel does not allow it quietly and it does not refuse it quietly. It asks.

Источник

If a rule blocks a tool for every possible argument, the model should not know the tool exists. Garu removes it from the list the model is offered.

Источник

The test I keep applying is simple: would I let this run while I sleep? With the rules in code, the record on disk and a cost cap on every run, the answer became yes.

Источник