Add support for Cedar as a policy language, in addition to TOML#34
Open
marcbrooker wants to merge 5 commits into
Open
Add support for Cedar as a policy language, in addition to TOML#34marcbrooker wants to merge 5 commits into
marcbrooker wants to merge 5 commits into
Conversation
Operators can now express sandbox authorization in the Cedar policy language in addition to the existing TOML configuration. Policies gate the full agent-sandbox action vocabulary at the Kernel boundary: fs:read/stat/write/list/create/delete/rename, env:read, net:request, and mcp:call. Semantics are additive-restriction-only: with no policy, behavior is unchanged (default-allow); with a policy loaded, a gated action must be permitted by Cedar or it is denied. This layers on top of the built-in SSRF and VFS-permission checks and can never weaken them. A policy can be supplied three ways: the `--policy <file>` CLI flag, `ShellBuilder::policy_file()`/`policy_str()`, or a `policy = "file.cedar"` key in the TOML config (resolved relative to the config file). Only the generic, public cedar-policy API is used. cedar-policy is not wasm-safe, so the dependency, the `policy` module, and all plumbing are gated to non-wasm; the `Kernel::check_policy` trait default is a no-op, so wasm builds compile with policy disabled.
Add an "Authorization Policies (Cedar)" section to the README covering the action vocabulary, the three ways to load a policy, and the additive-only composition with the SSRF guard and filesystem permissions. Add examples/ with three Cedar policies of increasing complexity (read-only, a workspace jail, and mixed controls with a forbid override) and a run-policies.sh script that runs each against strands-shell and shows which commands are allowed and which are denied.
Add `policy_file` and `policy_str` to the native PyO3 ShellBuilder, and surface them on the customer-facing `Shell` constructor as the `policy_file` (path) and `policy` (inline text) keyword args. Passing both raises; an explicit policy here overrides a `policy` key from a config_file. Update the README's policy section to show the Python API, and add pytest coverage for the read-only-from-Python, file-vs-inline, no-policy, mutual-exclusion, and malformed-policy cases.
Add two examples grounded in the "lethal trifecta" of agent security (private data + untrusted input + external communication), each cutting one leg: - 04-egress-allowlist.cedar — network only as GET to a single host; other hosts and non-GET methods are denied, closing the exfiltration channel. - 05-shield-secrets.cedar — full read/write of a project tree but a forbid override that blocks reading .env / .pem / .ssh / credentials. Extend run-policies.sh to demonstrate both and update the example and main READMEs.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Add support for Cedar as a policy language, in addition to TOML.
Type of Change
New feature
Breaking change
Documentation update
Other (please describe):
Testing
How have you tested the change? Verify that the changes do not break functionality or introduce new warnings.
cargo test --workspace --all-targets,pytest tests/python,npm test)cargo fmtandcargo clippyChecklist
By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.