prempti-falco-rules

You can enforce security guardrails on AI coding agents by authoring custom Falco rules that intercept tool calls and apply allow, deny, or ask-for-confirmation verdicts to prevent unauthorized actions.

To write a Falco rule blocking destructive shell commands, define a custom deny rule adhering to the coding_agent event source schema, targeting specific command patterns like rm -rf to stop execution.

Yes, you can prevent AI coding agents from accessing sensitive files like .env or .ssh/id_rsa by creating custom Falco rules that deny file access attempts and log the activity for auditing.

Yes, this Skill requires manual installation and management of the Falco rules via the premptictl CLI tool to enforce policy and monitor tool-call activity for your agentic workflows.

The coding_agent event source schema defines the specific data structure your custom Falco rules must adhere to when intercepting and evaluating tool calls made by AI coding agents.

Falco handles credential exfiltration by intercepting the agent's tool calls, evaluating them against your custom deny rules, and blocking the action while generating an audit log for threat mitigation.