@aporthq/aport-agent-guardrails 1.0.14 → 1.0.15
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/bin/agent-guardrails +19 -1
- package/package.json +1 -1
- package/skills/aport-agent-guardrail/SKILL.md +107 -330
package/bin/agent-guardrails
CHANGED
|
@@ -54,7 +54,25 @@ while [[ $# -gt 0 ]]; do
|
|
|
54
54
|
esac
|
|
55
55
|
done
|
|
56
56
|
|
|
57
|
-
# If no framework from args,
|
|
57
|
+
# If no framework from args, check if first REST argument is a framework name
|
|
58
|
+
if [[ -z "$framework" ]] && [[ ${#REST[@]} -gt 0 ]]; then
|
|
59
|
+
first_arg="${REST[0]}"
|
|
60
|
+
# Check if first arg looks like a framework name (lowercase alphanumeric + hyphen)
|
|
61
|
+
if [[ "$first_arg" =~ ^[a-z0-9-]+$ ]]; then
|
|
62
|
+
# Valid framework names
|
|
63
|
+
valid_frameworks=(openclaw langchain crewai cursor claude-code n8n)
|
|
64
|
+
for valid_fw in "${valid_frameworks[@]}"; do
|
|
65
|
+
if [[ "$first_arg" == "$valid_fw" ]]; then
|
|
66
|
+
framework="$first_arg"
|
|
67
|
+
# Remove framework from REST so remaining args are pass-through
|
|
68
|
+
REST=("${REST[@]:1}")
|
|
69
|
+
break
|
|
70
|
+
fi
|
|
71
|
+
done
|
|
72
|
+
fi
|
|
73
|
+
fi
|
|
74
|
+
|
|
75
|
+
# If still no framework from args, try APORT_FRAMEWORK (non-interactive) or detection
|
|
58
76
|
if [[ -z "$framework" ]]; then
|
|
59
77
|
if [[ -n "${APORT_FRAMEWORK:-}" ]]; then
|
|
60
78
|
framework="$APORT_FRAMEWORK"
|
package/package.json
CHANGED
|
@@ -1,91 +1,84 @@
|
|
|
1
1
|
---
|
|
2
2
|
name: aport-agent-guardrail
|
|
3
|
-
description:
|
|
4
|
-
|
|
5
|
-
|
|
3
|
+
description: >
|
|
4
|
+
Pre-action authorization for AI agents. Installs an OpenClaw before_tool_call hook that
|
|
5
|
+
evaluates every tool call against a passport and policy before execution. Blocks unauthorized
|
|
6
|
+
commands, data exfiltration, and policy violations. Supports local (offline) and hosted
|
|
7
|
+
(API) passport modes. Requires Node.js 18+ and npx.
|
|
8
|
+
metadata:
|
|
9
|
+
author: uchibeke
|
|
10
|
+
version: 1.1.11
|
|
11
|
+
tags: security, guardrails, authorization, ai-agent, openclaw, aport, policy-enforcement
|
|
6
12
|
---
|
|
7
13
|
|
|
8
14
|
# APort Agent Guardrail
|
|
9
15
|
|
|
10
|
-
|
|
16
|
+
Pre-action authorization for AI agents. Installs an OpenClaw `before_tool_call` hook that
|
|
17
|
+
evaluates every tool call against a passport (identity + capabilities + limits) and policy
|
|
18
|
+
**before** it executes. If the policy denies the call, the tool does not run.
|
|
11
19
|
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
**Pre-action authorization for AI agents.** Every tool call is evaluated against a passport (identity + capabilities + limits) and policy **before** it executes. If denied, the tool never runs.
|
|
20
|
+
This skill provides setup instructions. The enforcement logic comes from the
|
|
21
|
+
[@aporthq/aport-agent-guardrails](https://github.com/aporthq/aport-agent-guardrails)
|
|
22
|
+
npm package, which is open-source (Apache 2.0) and can be audited before installation.
|
|
17
23
|
|
|
18
|
-
|
|
19
|
-
- ✅ **Deterministic enforcement** – Runs in `before_tool_call` hook; agent cannot bypass
|
|
20
|
-
- ✅ **Blocks malicious actions** – Unauthorized commands, data exfiltration, API abuse prevented
|
|
21
|
-
- ✅ **Structured policies** – Based on [Open Agent Passport (OAP) v1.0](https://github.com/aporthq/aport-spec/tree/main)
|
|
22
|
-
- ✅ **Fail-closed by default** – Errors deny tool execution (security over availability)
|
|
23
|
-
- ✅ **Audit trail** – Every decision logged with tamper-evident hashes
|
|
24
|
-
- ✅ **Framework-agnostic** – OpenClaw, IronClaw, PicoClaw, and compatible runtimes
|
|
24
|
+
## When to use this skill
|
|
25
25
|
|
|
26
|
-
|
|
27
|
-
-
|
|
28
|
-
-
|
|
29
|
-
-
|
|
30
|
-
- Data exfiltration → File access, messaging, web requests controlled
|
|
31
|
-
- Resource exhaustion → Rate limits, size caps enforced
|
|
32
|
-
|
|
33
|
-
**Install once, protected forever.** The plugin runs automatically on every tool call.
|
|
34
|
-
|
|
35
|
-
---
|
|
26
|
+
- User wants to add guardrails to their AI agent setup
|
|
27
|
+
- User asks about protecting against unauthorized tool calls
|
|
28
|
+
- User wants pre-action authorization for OpenClaw, IronClaw, or PicoClaw agents
|
|
29
|
+
- User needs audit trails for AI agent actions
|
|
36
30
|
|
|
37
|
-
##
|
|
31
|
+
## How it works
|
|
38
32
|
|
|
39
|
-
```
|
|
40
|
-
|
|
41
|
-
|
|
33
|
+
```
|
|
34
|
+
User Request -> Agent Decision -> APort Hook -> [ALLOW/DENY] -> Tool Execution
|
|
35
|
+
|
|
|
36
|
+
Policy + Passport
|
|
37
|
+
```
|
|
42
38
|
|
|
43
|
-
|
|
44
|
-
|
|
39
|
+
1. Agent decides to use a tool (e.g., run a shell command)
|
|
40
|
+
2. OpenClaw fires the `before_tool_call` hook
|
|
41
|
+
3. APort loads the passport, maps the tool to a policy, checks allowlists and limits
|
|
42
|
+
4. Decision: ALLOW (tool runs) or DENY (tool blocked)
|
|
43
|
+
5. Decision is logged to the audit trail
|
|
45
44
|
|
|
46
|
-
|
|
47
|
-
|
|
48
|
-
|
|
45
|
+
Enforcement runs in the OpenClaw hook layer, not in agent prompts. However, like any
|
|
46
|
+
application-layer security control, it depends on the integrity of the runtime environment
|
|
47
|
+
(OS, OpenClaw, filesystem). See the [Security Model](https://github.com/aporthq/aport-agent-guardrails/blob/main/docs/SECURITY_MODEL.md) for trust boundaries.
|
|
49
48
|
|
|
50
|
-
|
|
51
|
-
```bash
|
|
52
|
-
# Get agent_id from aport.io
|
|
53
|
-
npx @aporthq/aport-agent-guardrails <agent_id>
|
|
54
|
-
```
|
|
49
|
+
## Prerequisites
|
|
55
50
|
|
|
56
|
-
|
|
51
|
+
Check these before starting:
|
|
57
52
|
|
|
58
|
-
|
|
53
|
+
1. **Node.js 18+** and **npx** — run `node -v` to verify (must show v18 or higher)
|
|
54
|
+
2. **OpenClaw** (or compatible runtime) — the hook registers as an OpenClaw plugin
|
|
59
55
|
|
|
60
|
-
##
|
|
56
|
+
## Installation
|
|
61
57
|
|
|
62
|
-
###
|
|
58
|
+
### Quick start (recommended)
|
|
63
59
|
|
|
64
60
|
```bash
|
|
65
61
|
npx @aporthq/aport-agent-guardrails
|
|
66
62
|
```
|
|
67
63
|
|
|
68
|
-
|
|
69
|
-
1. Create or load passport (local file or hosted from aport.io)
|
|
64
|
+
The wizard will:
|
|
65
|
+
1. Create or load a passport (local file or hosted from aport.io)
|
|
70
66
|
2. Configure capabilities and limits
|
|
71
|
-
3.
|
|
72
|
-
4. Set up wrapper scripts
|
|
67
|
+
3. Register the OpenClaw plugin (adds `before_tool_call` hook)
|
|
68
|
+
4. Set up wrapper scripts under `~/.openclaw/`
|
|
73
69
|
|
|
74
|
-
|
|
70
|
+
After install, the hook runs on every tool call automatically.
|
|
75
71
|
|
|
76
|
-
###
|
|
72
|
+
### With hosted passport (optional)
|
|
77
73
|
|
|
78
74
|
```bash
|
|
79
75
|
npx @aporthq/aport-agent-guardrails <agent_id>
|
|
80
76
|
```
|
|
81
77
|
|
|
82
|
-
Get `agent_id` at [aport.io](https://aport.io/builder/create/) for
|
|
83
|
-
|
|
84
|
-
- Global suspend (<200ms across all systems)
|
|
85
|
-
- Centralized audit and compliance dashboards
|
|
86
|
-
- Team collaboration
|
|
78
|
+
Get `agent_id` at [aport.io](https://aport.io/builder/create/) for signed decisions,
|
|
79
|
+
global suspend, and centralized audit dashboards.
|
|
87
80
|
|
|
88
|
-
###
|
|
81
|
+
### From source
|
|
89
82
|
|
|
90
83
|
```bash
|
|
91
84
|
git clone https://github.com/aporthq/aport-agent-guardrails
|
|
@@ -93,319 +86,103 @@ cd aport-agent-guardrails
|
|
|
93
86
|
./bin/openclaw
|
|
94
87
|
```
|
|
95
88
|
|
|
96
|
-
|
|
97
|
-
- [QuickStart: OpenClaw Plugin](https://github.com/aporthq/aport-agent-guardrails/blob/main/docs/QUICKSTART_OPENCLAW_PLUGIN.md)
|
|
98
|
-
- [Hosted passport setup](https://github.com/aporthq/aport-agent-guardrails/blob/main/docs/HOSTED_PASSPORT_SETUP.md)
|
|
89
|
+
### What gets installed
|
|
99
90
|
|
|
100
|
-
|
|
91
|
+
Files created under `~/.openclaw/`:
|
|
92
|
+
- Plugin config in `config.yaml` or `openclaw.json`
|
|
93
|
+
- Wrapper scripts in `.skills/aport-guardrail*.sh`
|
|
94
|
+
- `aport/passport.json` (local mode only)
|
|
95
|
+
- `aport/decision.json` and `aport/audit.log` (created at runtime)
|
|
101
96
|
|
|
102
|
-
|
|
97
|
+
Total disk usage: ~100KB for scripts + passport/decision files.
|
|
103
98
|
|
|
104
|
-
|
|
99
|
+
## Usage
|
|
105
100
|
|
|
106
|
-
|
|
101
|
+
After installation, the hook runs automatically on every tool call:
|
|
107
102
|
|
|
108
103
|
```bash
|
|
109
|
-
#
|
|
104
|
+
# Allowed command — hook approves, tool executes
|
|
110
105
|
agent> run git status
|
|
111
|
-
#
|
|
106
|
+
# APort: passport checked -> policy evaluated -> ALLOW
|
|
112
107
|
|
|
108
|
+
# Blocked command — hook denies, tool does not run
|
|
113
109
|
agent> run rm -rf /
|
|
114
|
-
#
|
|
110
|
+
# APort: passport checked -> blocked pattern detected -> DENY
|
|
115
111
|
```
|
|
116
112
|
|
|
117
|
-
|
|
118
|
-
|
|
119
|
-
### Testing the guardrail (optional)
|
|
120
|
-
|
|
121
|
-
**Direct script calls for testing or automation:**
|
|
113
|
+
### Testing the hook manually
|
|
122
114
|
|
|
123
115
|
```bash
|
|
124
|
-
# Test allowed command
|
|
116
|
+
# Test allowed command (exit 0 = ALLOW)
|
|
125
117
|
~/.openclaw/.skills/aport-guardrail.sh system.command.execute '{"command":"ls"}'
|
|
126
|
-
# Exit 0 = ALLOW
|
|
127
118
|
|
|
128
|
-
# Test blocked command
|
|
119
|
+
# Test blocked command (exit 1 = DENY)
|
|
129
120
|
~/.openclaw/.skills/aport-guardrail.sh system.command.execute '{"command":"rm -rf /"}'
|
|
130
|
-
# Exit 1 = DENY
|
|
131
|
-
|
|
132
|
-
# Test messaging
|
|
133
|
-
~/.openclaw/.skills/aport-guardrail.sh messaging.message.send '{"channel":"whatsapp","to":"+15551234567"}'
|
|
134
121
|
```
|
|
135
122
|
|
|
136
|
-
|
|
137
|
-
-
|
|
138
|
-
- `1` = DENY (reason in decision.json)
|
|
139
|
-
|
|
140
|
-
**Decision logs:**
|
|
141
|
-
- Latest: `~/.openclaw/aport/decision.json`
|
|
123
|
+
Decision logs:
|
|
124
|
+
- Latest decision: `~/.openclaw/aport/decision.json`
|
|
142
125
|
- Audit trail: `~/.openclaw/aport/audit.log`
|
|
143
|
-
- API mode: Signed receipts via APort API
|
|
144
|
-
|
|
145
|
-
---
|
|
146
|
-
|
|
147
|
-
## 🔍 How It Works
|
|
148
126
|
|
|
149
|
-
|
|
127
|
+
## Modes
|
|
150
128
|
|
|
151
|
-
|
|
152
|
-
User Request → Agent Decision → APort Check → [ALLOW/DENY] → Tool Execution
|
|
153
|
-
↑
|
|
154
|
-
Policy + Passport
|
|
155
|
-
```
|
|
156
|
-
|
|
157
|
-
1. **User makes request** (e.g., "Deploy to production")
|
|
158
|
-
2. **Agent decides to use tool** (e.g., exec.run with git push)
|
|
159
|
-
3. **OpenClaw fires hook** (`before_tool_call`)
|
|
160
|
-
4. **APort evaluates:**
|
|
161
|
-
- Load passport (identity, capabilities, limits)
|
|
162
|
-
- Map tool → policy (exec → system.command.execute.v1)
|
|
163
|
-
- Check allowlist, blocked patterns, rate limits
|
|
164
|
-
5. **Decision:** ALLOW or DENY
|
|
165
|
-
6. **Audit:** Log decision with timestamp, policy, reason codes
|
|
166
|
-
|
|
167
|
-
**Agent cannot bypass.** Hook is registered by OpenClaw, not controlled by prompts.
|
|
168
|
-
|
|
169
|
-
### What Gets Installed
|
|
170
|
-
|
|
171
|
-
**Plugin registration:**
|
|
172
|
-
- OpenClaw plugin added to config (enforces before_tool_call)
|
|
173
|
-
- TypeScript/JavaScript plugin loaded on OpenClaw start
|
|
174
|
-
|
|
175
|
-
**Files created (under ~/.openclaw/):**
|
|
176
|
-
- `config.yaml` or `openclaw.json` – Plugin configuration
|
|
177
|
-
- `.skills/aport-guardrail*.sh` – Wrapper scripts for local/API evaluation
|
|
178
|
-
- `aport/passport.json` – Your agent passport (local mode only)
|
|
179
|
-
- `aport/decision.json` – Latest decision (runtime)
|
|
180
|
-
- `aport/audit.log` – Audit trail (runtime)
|
|
181
|
-
|
|
182
|
-
**Total disk usage:** ~100KB scripts + your passport/decisions
|
|
183
|
-
|
|
184
|
-
**Review code:** [GitHub repository](https://github.com/aporthq/aport-agent-guardrails)
|
|
185
|
-
|
|
186
|
-
---
|
|
187
|
-
|
|
188
|
-
## 🌐 Network and Privacy
|
|
129
|
+
### Local mode (default)
|
|
189
130
|
|
|
190
|
-
|
|
131
|
+
- All evaluation happens on your machine, zero network calls
|
|
132
|
+
- Passport stored locally at `~/.openclaw/aport/passport.json`
|
|
133
|
+
- Works offline
|
|
134
|
+
- Note: local passport file must be protected from tampering (standard filesystem permissions)
|
|
191
135
|
|
|
192
|
-
|
|
193
|
-
- ✅ All evaluation on your machine
|
|
194
|
-
- ✅ Passport stored locally
|
|
195
|
-
- ✅ Decisions stay local
|
|
196
|
-
- ✅ Full privacy
|
|
197
|
-
- ✅ Works offline
|
|
136
|
+
### API mode (optional)
|
|
198
137
|
|
|
199
|
-
|
|
138
|
+
- Passport hosted in the aport.io registry (not stored locally)
|
|
139
|
+
- Signed decisions (Ed25519) for tamper-evident audit trails
|
|
140
|
+
- Global suspend across all systems
|
|
141
|
+
- Centralized compliance dashboards
|
|
142
|
+
- Sends tool name + context to API (does not send file contents, env vars, or credentials)
|
|
200
143
|
|
|
201
|
-
|
|
144
|
+
## Environment variables
|
|
202
145
|
|
|
203
|
-
|
|
204
|
-
- Tool name + context → APort API for policy evaluation
|
|
205
|
-
- Hosted passport fetched from registry (if using agent_id)
|
|
206
|
-
- Signed decisions returned (Ed25519 cryptographic signatures)
|
|
146
|
+
All optional. Local mode requires no environment variables.
|
|
207
147
|
|
|
208
|
-
|
|
209
|
-
- ✅ Cryptographically signed decisions
|
|
210
|
-
- ✅ Court-admissible audit trail
|
|
211
|
-
- ✅ Global suspend across all systems
|
|
212
|
-
- ✅ Centralized compliance dashboards
|
|
213
|
-
- ✅ No local passport tampering possible
|
|
214
|
-
|
|
215
|
-
**API endpoint:** `https://api.aport.io` (or custom via APORT_API_URL)
|
|
216
|
-
|
|
217
|
-
**Data sent:**
|
|
218
|
-
- Tool name (e.g., "system.command.execute")
|
|
219
|
-
- Context (e.g., {"command": "ls"})
|
|
220
|
-
- Passport (if local) or agent_id (if hosted)
|
|
221
|
-
|
|
222
|
-
**Data NOT sent:**
|
|
223
|
-
- File contents
|
|
224
|
-
- Environment variables
|
|
225
|
-
- API keys or credentials
|
|
226
|
-
- Unrelated system information
|
|
227
|
-
|
|
228
|
-
**To verify:** Use local mode (no network) or inspect open-source code.
|
|
229
|
-
|
|
230
|
-
---
|
|
231
|
-
|
|
232
|
-
## ⚙️ Environment Variables
|
|
233
|
-
|
|
234
|
-
| Variable | When Used | Purpose |
|
|
148
|
+
| Variable | When used | Purpose |
|
|
235
149
|
|----------|-----------|---------|
|
|
236
|
-
| `APORT_API_URL` | API mode | Override endpoint (default: `https://api.aport.io`)
|
|
237
|
-
| `APORT_AGENT_ID` | Hosted passport | Passport ID from aport.io
|
|
238
|
-
| `APORT_API_KEY` | If API requires auth | Authentication token
|
|
239
|
-
|
|
240
|
-
**Local mode:** No environment variables needed. Passport read from `~/.openclaw/aport/passport.json`.
|
|
150
|
+
| `APORT_API_URL` | API mode | Override endpoint (default: `https://api.aport.io`) |
|
|
151
|
+
| `APORT_AGENT_ID` | Hosted passport | Passport ID from aport.io |
|
|
152
|
+
| `APORT_API_KEY` | If API requires auth | Authentication token |
|
|
241
153
|
|
|
242
|
-
|
|
154
|
+
## Default protections
|
|
243
155
|
|
|
244
|
-
|
|
156
|
+
- **Shell commands** — Allowlist enforcement, 40+ blocked patterns (`rm -rf`, `sudo`, `chmod 777`, etc.), interpreter bypass detection
|
|
157
|
+
- **Messaging** — Rate limits, recipient allowlist, channel restrictions
|
|
158
|
+
- **File access** — Path restrictions, blocks access to `.env`, SSH keys, system directories
|
|
159
|
+
- **Web requests** — Domain allowlist, SSRF protection, rate limiting
|
|
160
|
+
- **Git operations** — PR size limits, branch restrictions
|
|
245
161
|
|
|
246
|
-
##
|
|
162
|
+
## Tool name mapping
|
|
247
163
|
|
|
248
|
-
|
|
|
249
|
-
|
|
164
|
+
| Agent action | Tool name | Policy checks |
|
|
165
|
+
|--------------|-----------|---------------|
|
|
250
166
|
| Shell commands | `system.command.execute` | Allowlist, blocked patterns |
|
|
251
|
-
| WhatsApp/Email/Slack | `messaging.message.send` | Rate limits, recipient allowlist |
|
|
252
|
-
|
|
|
167
|
+
| Messaging (WhatsApp/Email/Slack) | `messaging.message.send` | Rate limits, recipient allowlist |
|
|
168
|
+
| PRs | `git.create_pr`, `git.merge` | PR size, branch restrictions |
|
|
253
169
|
| MCP tools | `mcp.tool.execute` | Server/tool allowlist |
|
|
254
|
-
| Data export | `data.export` | Row limits, PII filtering |
|
|
255
170
|
| File read/write | `data.file.read`, `data.file.write` | Path restrictions |
|
|
256
|
-
| Web requests | `web.fetch`, `web.browser` | Domain allowlist
|
|
257
|
-
|
|
258
|
-
**Context format:** Valid JSON, e.g., `'{"command":"ls"}'` or `'{"channel":"whatsapp","to":"+1..."}'`
|
|
171
|
+
| Web requests | `web.fetch`, `web.browser` | Domain allowlist |
|
|
259
172
|
|
|
260
|
-
|
|
173
|
+
## Troubleshooting
|
|
261
174
|
|
|
262
|
-
|
|
175
|
+
| Problem | Fix |
|
|
176
|
+
|---------|-----|
|
|
177
|
+
| Plugin not enforcing | Check `openclaw plugin list` shows aport-guardrail |
|
|
178
|
+
| Connection refused (API mode) | Verify `APORT_API_URL` is reachable |
|
|
179
|
+
| Tool blocked unexpectedly | Check `~/.openclaw/aport/decision.json` for deny reason |
|
|
180
|
+
| npx not found | Install Node.js 18+: https://nodejs.org |
|
|
263
181
|
|
|
264
|
-
|
|
265
|
-
- Allowlist enforcement (only specified commands run)
|
|
266
|
-
- 40+ blocked patterns: `rm -rf`, `sudo`, `chmod 777`, `dd if=`, `mkfs`, etc.
|
|
267
|
-
- Interpreter bypasses blocked: `python -c`, `node -e`, `base64` encoding
|
|
268
|
-
- Command injection patterns detected
|
|
182
|
+
## Documentation
|
|
269
183
|
|
|
270
|
-
|
|
271
|
-
- Rate limits (msgs_per_min, msgs_per_day)
|
|
272
|
-
- Recipient allowlist
|
|
273
|
-
- Channel restrictions
|
|
274
|
-
|
|
275
|
-
**File access (data.file.read/write.v1):**
|
|
276
|
-
- Path restrictions (block /etc, /bin, system directories)
|
|
277
|
-
- Prevent .env, SSH key theft
|
|
278
|
-
|
|
279
|
-
**Web requests (web.fetch/browser.v1):**
|
|
280
|
-
- Domain allowlist
|
|
281
|
-
- SSRF protection (block private IPs)
|
|
282
|
-
- Rate limiting
|
|
283
|
-
|
|
284
|
-
**Git operations (code.repository.merge.v1):**
|
|
285
|
-
- PR size limits
|
|
286
|
-
- Branch restrictions
|
|
287
|
-
- Review requirements
|
|
288
|
-
|
|
289
|
-
**All policies at:** https://aport.io/policy-packs
|
|
290
|
-
|
|
291
|
-
---
|
|
292
|
-
|
|
293
|
-
## 🔐 Security Model
|
|
294
|
-
|
|
295
|
-
### What APort Protects
|
|
296
|
-
|
|
297
|
-
**✅ Agent action security:**
|
|
298
|
-
- Prompt injection (hook-based enforcement, not prompt-based)
|
|
299
|
-
- Malicious third-party skills
|
|
300
|
-
- Unauthorized commands
|
|
301
|
-
- Data exfiltration via files, messaging, web requests
|
|
302
|
-
- Resource exhaustion (rate/size limits)
|
|
303
|
-
|
|
304
|
-
### Trust Model
|
|
305
|
-
|
|
306
|
-
**APort operates at the application layer** (between agent decision and tool execution).
|
|
307
|
-
|
|
308
|
-
**You must trust:**
|
|
309
|
-
- Your operating system (file permissions, process isolation)
|
|
310
|
-
- OpenClaw runtime (hooks execute correctly)
|
|
311
|
-
- APort code (open-source, verifiable)
|
|
312
|
-
|
|
313
|
-
**Local mode additionally trusts:**
|
|
314
|
-
- Filesystem integrity (passport not tampered)
|
|
315
|
-
|
|
316
|
-
**API mode eliminates:**
|
|
317
|
-
- Local passport tampering (fetched from API)
|
|
318
|
-
- Decision tampering (cryptographically signed)
|
|
319
|
-
|
|
320
|
-
**Out of scope (OS/infrastructure security):**
|
|
321
|
-
- File system compromise
|
|
322
|
-
- OpenClaw CVEs
|
|
323
|
-
- Network attacks (MITM, DNS poisoning)
|
|
324
|
-
- Supply chain attacks
|
|
325
|
-
|
|
326
|
-
**This is standard for application-layer authorization** (same model as OAuth, IAM, policy engines).
|
|
327
|
-
|
|
328
|
-
---
|
|
329
|
-
|
|
330
|
-
## 🎯 Use Cases
|
|
331
|
-
|
|
332
|
-
**Protect against malicious skills:**
|
|
333
|
-
- Install APort before adding community skills
|
|
334
|
-
- Every skill's tool calls are checked
|
|
335
|
-
- Malicious actions blocked before execution
|
|
336
|
-
|
|
337
|
-
**Compliance and audit:**
|
|
338
|
-
- Tamper-evident decision logs
|
|
339
|
-
- Court-admissible audit trail (API mode with Ed25519 signatures)
|
|
340
|
-
- SOC 2, HIPAA, SOX compliance support
|
|
341
|
-
|
|
342
|
-
**Team deployments:**
|
|
343
|
-
- Shared passport across systems (global suspend)
|
|
344
|
-
- Centralized policy updates
|
|
345
|
-
- Consistent enforcement
|
|
346
|
-
|
|
347
|
-
**Air-gapped environments:**
|
|
348
|
-
- Use local mode (zero network)
|
|
349
|
-
- All evaluation on-premise
|
|
350
|
-
- Self-hosted policy packs
|
|
351
|
-
|
|
352
|
-
---
|
|
353
|
-
|
|
354
|
-
## 📚 Documentation
|
|
355
|
-
|
|
356
|
-
**APort Guardrails:**
|
|
184
|
+
- [Source code](https://github.com/aporthq/aport-agent-guardrails) (Apache 2.0)
|
|
357
185
|
- [QuickStart: OpenClaw Plugin](https://github.com/aporthq/aport-agent-guardrails/blob/main/docs/QUICKSTART_OPENCLAW_PLUGIN.md)
|
|
358
186
|
- [Security Model & Trust Boundaries](https://github.com/aporthq/aport-agent-guardrails/blob/main/docs/SECURITY_MODEL.md)
|
|
359
187
|
- [Hosted Passport Setup](https://github.com/aporthq/aport-agent-guardrails/blob/main/docs/HOSTED_PASSPORT_SETUP.md)
|
|
360
|
-
- [
|
|
361
|
-
- [Verification Methods (Local vs API)](https://github.com/aporthq/aport-agent-guardrails/blob/main/docs/VERIFICATION_METHODS.md)
|
|
362
|
-
|
|
363
|
-
**OpenClaw:**
|
|
364
|
-
- [CLI: skills](https://docs.openclaw.ai/cli/skills)
|
|
365
|
-
- [Skills Documentation](https://docs.openclaw.ai/tools/skills)
|
|
366
|
-
- [Skills Config](https://docs.openclaw.ai/tools/skills-config)
|
|
367
|
-
- [ClawHub](https://docs.openclaw.ai/tools/clawhub)
|
|
368
|
-
|
|
369
|
-
**Security:**
|
|
370
|
-
- [SECURITY.md](https://github.com/aporthq/aport-agent-guardrails/blob/main/SECURITY.md) - Prompt injection, Cisco findings
|
|
371
|
-
- [OAP Specification](https://github.com/aporthq/aport-spec/tree/main) - Open Agent Passport standard
|
|
372
|
-
|
|
373
|
-
---
|
|
374
|
-
|
|
375
|
-
## 🤝 Support and Community
|
|
376
|
-
|
|
377
|
-
**GitHub:** [aporthq/aport-agent-guardrails](https://github.com/aporthq/aport-agent-guardrails)
|
|
378
|
-
**Website:** [aport.io](https://aport.io)
|
|
379
|
-
**Issues:** [GitHub Issues](https://github.com/aporthq/aport-agent-guardrails/issues)
|
|
380
|
-
|
|
381
|
-
**Open-source:** Apache 2.0 License
|
|
382
|
-
**Code review:** All code publicly available for inspection
|
|
383
|
-
|
|
384
|
-
---
|
|
385
|
-
|
|
386
|
-
## ❓ FAQ
|
|
387
|
-
|
|
388
|
-
**Q: Does this slow down my agent?**
|
|
389
|
-
A: Minimal overhead. API mode: ~60-100ms. Local mode: <300ms. Runs in parallel with agent thinking.
|
|
390
|
-
|
|
391
|
-
**Q: Can I use this offline?**
|
|
392
|
-
A: Yes. Local mode works without network connectivity.
|
|
393
|
-
|
|
394
|
-
**Q: What if I need custom policies?**
|
|
395
|
-
A: API mode: Pass custom policy JSON in request. Local mode: Edit bash script or use API mode.
|
|
396
|
-
|
|
397
|
-
**Q: How do I suspend my agent?**
|
|
398
|
-
A: Local: Set passport status to "suspended". Hosted: Log in to aport.io and suspend (global effect).
|
|
399
|
-
|
|
400
|
-
**Q: Is my data sent to APort?**
|
|
401
|
-
A: Local mode: No. API mode: Tool name + context only (no credentials, file contents, or env vars).
|
|
402
|
-
|
|
403
|
-
**Q: Can the agent bypass this?**
|
|
404
|
-
A: No. Enforcement is in the platform hook (`before_tool_call`), not controllable by prompts.
|
|
405
|
-
|
|
406
|
-
**Q: What happens if APort errors?**
|
|
407
|
-
A: Default: Tool blocked (fail-closed). Configurable via `failClosed` setting.
|
|
408
|
-
|
|
409
|
-
---
|
|
410
|
-
|
|
411
|
-
**Made with 🛡️ by [APort](https://aport.io) · Open-source on [GitHub](https://github.com/aporthq/aport-agent-guardrails) · Apache 2.0 License**
|
|
188
|
+
- [OAP Specification](https://github.com/aporthq/aport-spec/tree/main)
|