A Policy Kernel, Not a Prompt

说明与用途

Garu 的策略内核通过隐藏禁止使用的工具并要求对未匹配调用进行用户确认，确保无人值守代理的安全运行。

问题

An always‑on agent with access to email, files, and repositories must be restricted to prevent unintended actions.

结果

By moving policy enforcement into a kernel and hiding disallowed tools, the author achieved a safe unattended agent that only performs approved actions and logs all decisions.

工作流

• Define a YAML policy file listing allowed, asked, or blocked tools and argument conditions.
• Deploy the policy kernel with the agent; the kernel intercepts every tool call.
• The kernel evaluates rules top‑to‑bottom; the first match decides the action.
• If no rule matches, the kernel presents an ask card and waits up to 30 min for a response.
• Unanswered asks default to denial.
• Record every decision for audit and replay.
• Run each tool server in a sandbox container for isolation.
• Iterate policy rules to refine allowed actions.
• Test by simulating overnight runs to confirm safety.
• Publish the policy and kernel as open source under Apache‑2.0.

证据

An agent that runs all night with access to my email, my files and my repositories has to answer one question before anything else: what exactly can it touch?

来源

The kernel reads the list top to bottom, and the first rule that matches decides.

来源

If no rule matches a call, the kernel does not allow it quietly and it does not refuse it quietly. It asks.

来源

If a rule blocks a tool for every possible argument, the model should not know the tool exists. Garu removes it from the list the model is offered.

来源

The test I keep applying is simple: would I let this run while I sleep? With the rules in code, the record on disk and a cost cap on every run, the answer became yes.

来源