Stop eyeballing your agent's permissions. Prove them.

Описание и применение

Провайдер OpenShell позволяет автоматически находить конкретные нарушения политик, которые легко пропустить при ручном просмотре.

Задача

Reading permission files by eye misses subtle policy combinations that allow unintended access.

Результат

The prover quickly identifies exact requests or filesystem writes that violate a boundary, revealing leaks that manual review would miss.

Рабочий процесс

• Write a boundary policy for the parent agent.
• Generate a candidate policy for a child agent.
• Run openshell-prover with the boundary and candidate files.
• Interpret the prover’s output: if exit code 0, policy is within boundary; otherwise, examine the counterexample or unsupported message.
• Adjust the candidate policy accordingly and re‑run.

Доказательства

The sandbox blocked the agent's write to a GitHub repo it was not allowed to touch.

Источник

The prover says within_boundary and exits 0.

Источник

result: exceeds_boundary counterexample: network binary=- ancestor_binary=- binary_identity_required=false host=api.github.com:443 protocol=rest method=POST path=/repos/acme/app/issues

Источник

When the prover cannot answer, it says so and exits 3, instead of passing.

Источник