YAML Policy Template for Production Agents

Production agents need policies that are strict by default and explicit about every permitted action. This template provides a starting point for agents operating in production environments where safety and compliance are priorities.

version: "1.0"
name: "production-agent-policy"
description: "Strict policy for production deployment"

defaults:
  action: deny
  log: true
  notify: false

rules:
  # Allow read-only data retrieval
  - name: "allow-data-reads"
    match:
      tool: "database_query"
      parameters:
        query:
          pattern: "^SELECT"
    action: allow

  # Allow sending pre-approved message templates
  - name: "allow-templated-messages"
    match:
      tool: "send_message"
      parameters:
        template_id:
          in: ["welcome", "confirmation", "followup"]
    action: allow

  # Require approval for any write operations
  - name: "approve-data-writes"
    match:
      tool: "database_query"
      parameters:
        query:
          pattern: "^(INSERT|UPDATE)"
    action: approve
    approval:
      timeout: 300
      approvers: ["ops-team"]

  # Block all destructive operations
  - name: "block-destructive"
    match:
      tool: "database_query"
      parameters:
        query:
          pattern: "^(DELETE|DROP|TRUNCATE|ALTER)"
    action: deny

  # Block external network calls
  - name: "block-external-http"
    match:
      tool: "http_request"
      parameters:
        url:
          not_pattern: "^https://api\\.internal\\."
    action: deny

Key design decisions in this template:

Deny by default. Any tool or action not explicitly listed is blocked. This prevents new tools from being usable without a policy review.

Read/write separation. Read operations are allowed. Write operations require approval. Destructive operations are denied entirely.

Parameter constraints. Tool calls are not just matched by name. Parameters are inspected to ensure they conform to expected patterns.

Approval timeouts. Approval requests expire after 300 seconds. If no human responds, the action is denied. This prevents the agent from stalling indefinitely.

Customize this template by adjusting the tool names, parameter patterns, and approval configurations to match your specific deployment. Test every rule with both legitimate and adversarial inputs before deploying.