Decide what every AI agent may do, prove what it did, stop it when it shouldn't
A coding agent read an injected line and tried to send .env to a paste site. Below is what ascc answered, running here as WebAssembly: the same Go code as the command-line tool, on a planted repo with fictional agents. Change the policy, replay the calls, edit the audit log, stop an agent.
Loading the policy engine…
Tool calls the agent asked for
Each call goes through the hook: the command is parsed into facts, the policies decide, and the answer is written to the audit log before it counts. No matching permit is a deny.
Cedar policies
Edit a rule, then replay. A policy that doesn't load denies every call and says why.
Kill switch
A suspended agent is denied everything before any policy runs, so removing a rule can't bring it back. Both actions are recorded. It stops the agent here only: the service accounts and keys it holds still work until someone rotates them, and the command-line tool lists them.
Hash-chained audit log
Every line holds the hash of the line before it, and a hash of the tool input, never the input. Change any character and the check below names the line; calls made afterwards don't mend it. Break the last line so it no longer reads as an entry and the next call is blocked, because a call that can't be recorded doesn't happen. Lines cut off the end still verify: the command-line tool catches that with a head hash you recorded elsewhere.