skills.rest
AskTinNguyen
AskTinNguyenCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

agent-policy-engine

Enforce persona-level hard-deny policies on AI agent tool usage.

1|Updated Jan 26, 2026
Search Tags:#security#validation#permissions#ai-agent#policy#deny-list#runtime-enforcement
One-click install
npx skills add https://github.com/AskTinNguyen/vesper-team-skills --skill agent-policy-engine
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: agent-policy-engine
Source: https://github.com/AskTinNguyen/vesper-team-skills/tree/main/agent-policy-engine
Command: npx skills add https://github.com/AskTinNguyen/vesper-team-skills --skill agent-policy-engine

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Policy-driven hard-deny controls block dangerous AI-agent tooling, preventing unauthorized file I/O, shell commands, API access, and network requests at runtime.

Core Features & Use Cases

  • Five-level cascading scope (global → workspace → persona → session → runtime) guarantees predictable policy resolution.
  • Dual permission model (allow-list workspace vs deny-list persona) provides layered protection and safe defaults.
  • PreToolUse hard-deny enforcement ensures blocked tools never reach permission logic, with runtime policy snapshots for isolation.
  • Policy editor/UI IPC: load, edit, test, and apply policies across personas without restarting sessions.
  • Real-world scenarios include onboarding new personas, auditing risky tools, and enforcing compliance.

Quick Start

Create a minimal permissions.json and load it into the agent to enforce hard-deny rules at runtime.

Frequently Asked Questions about agent-policy-engine

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I enforce hard-deny policies to block dangerous AI agent tool usage at runtime?▼

You enforce hard-deny policies by loading a JSON policy schema into the agent runtime, which blocks unauthorized file I/O, shell commands, MCP server tools, API endpoints, and network requests before they execute.

What is a cascading five-level scope for AI agent permissions?▼

A cascading five-level scope resolves permissions predictably across global, workspace, persona, session, and runtime layers, ensuring that more specific runtime policies override broader global configurations.

How do I prevent an AI agent from executing dangerous shell commands without restarting the session?▼

You prevent dangerous shell commands by applying PreToolUse hard-deny enforcement with a policy editor, allowing you to load, edit, test, and apply deny-list rules across personas without restarting sessions.

Does the dual permission model use allow-lists or deny-lists for AI agent security?▼

The dual permission model combines both: it uses an allow-list for workspace-level access and a deny-list for persona-level restrictions, providing layered protection with safe defaults.

When do I need runtime policy snapshots for AI agent enforcement?▼

You need runtime policy snapshots when you require isolation during enforcement, ensuring that blocked tools never reach permission logic and that active policies remain consistent during execution.

Can I use glob and regex patterns to define AI agent file I/O restrictions?▼

Yes, you can define file I/O restrictions using built-in glob and regex utilities within your JSON policy schema to precisely match and block unauthorized file access patterns.

Related Skills

Explore More Software Engineering Skills→
teegin-gteegin-g

databricks-spark-declarative-pipelines

Configure Databricks SDP assets with Asset Bundles and serverless compute.

Community
Advanced
niclasmartinsson-sysniclasmartinsson-sys
8

gws-admin-reports

Consolidates Google Workspace Admin SDK audit logs and usage reports for domain-level analytics via authenticated API requests.

Community
Intermediate
vanman2024vanman2024
3

MCP Development

Scaffold and validate FastMCP MCP server structures with scripts.

Community
Intermediate
markus41markus41
18

Claude Code Permissions & Security

Explain Claude Code permission modes and allow/deny list configuration.

Community
Intermediate