@paybond/kit 0.11.1 → 0.11.3

package/README.md

@@ -12,7 +12,7 @@ Paybond is the SDK to use when you do not want to build your own delegated agent
 npm install @paybond/kit
 ```
 
-`@paybond/kit` is an ESM-only package for modern Node.js runtimes. Use `import` from a Node ESM / `NodeNext` project or a compatible bundler.
+`@paybond/kit` is an ESM-only package for Node.js runtimes. Use `import` from a Node ESM / `NodeNext` project or a compatible bundler.
 
 ### Optional framework integrations
 

package/dist/agent/facade.d.ts

@@ -1,4 +1,4 @@
-import type { ClaudeAgentsConfig } from "../claude-agents/index.js";
+import type { ClaudeAgentsConfig } from "../claude-agents/config.js";
 import type { PaybondLangGraphHooks } from "../langgraph/config.js";
 import { createOpenAIAgentsAdapter } from "../openai-agents/index.js";
 import type { PaybondPolicy } from "../policy/load.js";

package/dist/agent/facade.js

@@ -1,4 +1,4 @@
-import { createPaybondClaudeAgentsConfig } from "../claude-agents/index.js";
+import { createPaybondClaudeAgentsConfig } from "../claude-agents/config.js";
 import { createPaybondOpenAIAgentsConfig } from "../openai-agents/index.js";
 import { isKnownPolicyPresetId, resolvePolicyPresetPath } from "../policy/presets.js";
 import { createPaybondVercelAgentConfig } from "../vercel-ai/config.js";

package/dist/agent/guarded-agent.d.ts

@@ -6,7 +6,7 @@ import type { PolicyValidatorOptions } from "../policy/validate.js";
 import { paybondVercelToolApproval } from "../vercel-ai/tool-approval.js";
 import { type PaybondLangGraphAwrapToolCall } from "../langgraph/awrap-tool-call.js";
 import { paybondToolNode } from "../langgraph/tool-node.js";
-import { type ClaudeAgentsConfig } from "../claude-agents/index.js";
+import { type ClaudeAgentsConfig } from "../claude-agents/config.js";
 import type { PaybondToolRegistry } from "./registry.js";
 import type { PaybondAgentRunHost } from "./run.js";
 import { PaybondAgentRun } from "./run.js";

package/dist/agent/guarded-agent.js

@@ -2,7 +2,7 @@ import { createOpenAIAgentsAdapter, createPaybondOpenAIAgentsConfig, } from "../
 import { PaybondPolicy } from "../policy/load.js";
 import { createPaybondVercelAgentConfig } from "../vercel-ai/config.js";
 import { createPaybondLangGraphHooks } from "../langgraph/config.js";
-import { createPaybondClaudeAgentsConfig, } from "../claude-agents/index.js";
+import { createPaybondClaudeAgentsConfig, } from "../claude-agents/config.js";
 import { createPaybondGenericAgentConfig, } from "./generic-runner.js";
 import { PaybondAgentRun } from "./run.js";
 async function resolvePolicy(source) {

package/dist/claude-agents/config.d.ts

@@ -1,4 +1,4 @@
-import { createSdkMcpServer, type SdkMcpToolDefinition } from "@anthropic-ai/claude-agent-sdk";
+import type { SdkMcpToolDefinition } from "@anthropic-ai/claude-agent-sdk";
 import type { PaybondAgentRun } from "../agent/run.js";
 /** Pre-built SDK tool from `tool()` in `@anthropic-ai/claude-agent-sdk`. */
 export type ClaudeAgentSdkTool = SdkMcpToolDefinition;
@@ -9,7 +9,7 @@ export type PaybondClaudeAgentsConfigOptions = {
     serverVersion?: string;
 };
 export type ClaudeAgentsConfig = {
-    mcpServer: ReturnType<typeof createSdkMcpServer>;
+    mcpServer: ReturnType<typeof import("@anthropic-ai/claude-agent-sdk").createSdkMcpServer>;
     allowedTools: string[];
     /** Same tool array as input — side-effecting handlers are wrapped in-place. */
     agentTools: ClaudeAgentSdkTool[];

package/dist/claude-agents/config.js

@@ -1,6 +1,26 @@
-import { createSdkMcpServer, } from "@anthropic-ai/claude-agent-sdk";
+import { createRequire } from "node:module";
 import { PaybondAutoEvidenceSubmitError, PaybondUnregisteredSideEffectingToolError, } from "../agent/types.js";
 import { PaybondSpendApprovalRequiredError, PaybondSpendDeniedError, } from "../index.js";
+let cachedClaudeAgentSdk;
+/**
+ * Lazily resolve the optional `@anthropic-ai/claude-agent-sdk` peer dependency.
+ *
+ * Importing this module must not require the peer to be installed, so the Paybond barrel
+ * can load for consumers of other frameworks. The peer is only needed when the Claude Agents
+ * config is actually built.
+ */
+function loadClaudeAgentSdk() {
+    if (cachedClaudeAgentSdk === undefined) {
+        try {
+            const require = createRequire(import.meta.url);
+            cachedClaudeAgentSdk = require("@anthropic-ai/claude-agent-sdk");
+        }
+        catch (err) {
+            throw new Error('The Claude Agents integration requires the optional peer dependency "@anthropic-ai/claude-agent-sdk"; install it with: npm install @anthropic-ai/claude-agent-sdk', { cause: err });
+        }
+    }
+    return cachedClaudeAgentSdk;
+}
 function claudeMcpAllowedToolName(serverName, toolName) {
     return `mcp__${serverName}__${toolName}`;
 }
@@ -127,6 +147,7 @@ function wrapClaudeAgentSdkTool(run, sdkTool) {
  * into an in-process MCP server for `query({ options: { mcpServers, allowedTools } })`.
  */
 export function createPaybondClaudeAgentsConfig(run, tools, options) {
+    const { createSdkMcpServer } = loadClaudeAgentSdk();
     const sdkTools = assertClaudeAgentSdkTools(tools);
     const serverName = options?.serverName?.trim() || "paybond";
     for (const sdkTool of sdkTools) {

package/dist/cli/commands/agent.js

@@ -1,6 +1,7 @@
 import { resolve } from "node:path";
 import { readFile } from "node:fs/promises";
-import { PaybondAgentRun, PaybondAutoEvidenceSubmitError, PaybondToolRegistryValidationError, PaybondUnregisteredSideEffectingToolError, } from "../../agent/index.js";
+import { PaybondAgentRun } from "../../agent/run.js";
+import { PaybondAutoEvidenceSubmitError, PaybondToolRegistryValidationError, PaybondUnregisteredSideEffectingToolError, } from "../../agent/types.js";
 import { runGenericSandboxDemo } from "../../agent/generic-sandbox-demo.js";
 import { loadRunClaudeAgentsSandboxDemo, loadRunLangGraphSandboxDemo, loadRunOpenAIAgentsSandboxDemo, loadRunVercelAiSandboxDemo, } from "../agent/demo-loaders.js";
 import { buildSmokeRegistry, loadAgentRegistryFile, validateAgentRegistryDocument, } from "../../agent/registry-file.js";

package/dist/langgraph/awrap-tool-call.d.ts

@@ -1,5 +1,5 @@
-import { ToolMessage } from "@langchain/core/messages";
-import { type Command } from "@langchain/langgraph";
+import type { ToolMessage } from "@langchain/core/messages";
+import type { Command } from "@langchain/langgraph";
 import type { PaybondAgentRun } from "../agent/run.js";
 /** LangGraph `ToolCallRequest`-compatible shape used by Paybond interceptors. */
 export type PaybondLangGraphToolCallRequest = {

package/dist/langgraph/awrap-tool-call.js

@@ -1,7 +1,41 @@
-import { ToolMessage } from "@langchain/core/messages";
-import { isCommand } from "@langchain/langgraph";
+import { createRequire } from "node:module";
 import { PaybondAutoEvidenceSubmitError, PaybondUnregisteredSideEffectingToolError, } from "../agent/types.js";
 import { PaybondSpendApprovalRequiredError, PaybondSpendDeniedError, } from "../index.js";
+let cachedCoreMessages;
+let cachedLangGraph;
+function missingLangGraphPeerError(err) {
+    return new Error('The LangGraph integration requires the optional peer dependencies "@langchain/core" and "@langchain/langgraph"; install them with: npm install @langchain/core @langchain/langgraph', { cause: err });
+}
+/**
+ * Lazily resolve `@langchain/core/messages`; importing this module must not require the peer.
+ */
+function loadCoreMessages() {
+    if (cachedCoreMessages === undefined) {
+        try {
+            const require = createRequire(import.meta.url);
+            cachedCoreMessages = require("@langchain/core/messages");
+        }
+        catch (err) {
+            throw missingLangGraphPeerError(err);
+        }
+    }
+    return cachedCoreMessages;
+}
+/**
+ * Lazily resolve `@langchain/langgraph`; importing this module must not require the peer.
+ */
+function loadLangGraph() {
+    if (cachedLangGraph === undefined) {
+        try {
+            const require = createRequire(import.meta.url);
+            cachedLangGraph = require("@langchain/langgraph");
+        }
+        catch (err) {
+            throw missingLangGraphPeerError(err);
+        }
+    }
+    return cachedLangGraph;
+}
 function toolCallFields(request) {
     const call = request.tool_call;
     return {
@@ -11,6 +45,7 @@ function toolCallFields(request) {
     };
 }
 function denyToolMessage(name, toolCallId, content) {
+    const { ToolMessage } = loadCoreMessages();
     return new ToolMessage({
         content,
         name: name || "unknown",
@@ -19,9 +54,11 @@ function denyToolMessage(name, toolCallId, content) {
     });
 }
 function isToolMessage(value) {
-    return value instanceof ToolMessage;
+    return value instanceof loadCoreMessages().ToolMessage;
 }
 export function normalizeLangGraphHookResult(call, result) {
+    const { isCommand } = loadLangGraph();
+    const { ToolMessage } = loadCoreMessages();
     if (isToolMessage(result) || isCommand(result)) {
         return result;
     }

package/dist/langgraph/tool-node.d.ts

@@ -1,10 +1,13 @@
 import type { DynamicTool, StructuredToolInterface } from "@langchain/core/tools";
 import type { RunnableToolLike } from "@langchain/core/runnables";
-import { ToolNode, type ToolNodeOptions } from "@langchain/langgraph/prebuilt";
+import type { ToolNode, ToolNodeOptions } from "@langchain/langgraph/prebuilt";
 import type { PaybondAgentRun } from "../agent/run.js";
 type LangGraphTool = StructuredToolInterface | DynamicTool | RunnableToolLike;
 /**
  * Convenience factory: `ToolNode` with Paybond spend guard + auto-evidence on every tool call.
+ *
+ * LangGraph JS does not yet expose `awrapToolCall` on `ToolNode`; the returned subclass provides
+ * the same interceptor boundary as Python's `ToolNode(..., awrap_tool_call=...)`.
  */
 export declare function paybondToolNode(tools: LangGraphTool[], run: PaybondAgentRun, options?: ToolNodeOptions): ToolNode;
 export {};

package/dist/langgraph/tool-node.js

@@ -1,38 +1,56 @@
-import { ToolNode } from "@langchain/langgraph/prebuilt";
+import { createRequire } from "node:module";
 import { normalizeLangGraphHookResult, paybondAwrapToolCall, } from "./awrap-tool-call.js";
+let cachedPrebuilt;
 /**
- * `ToolNode` subclass that runs {@link paybondAwrapToolCall} before each tool invocation.
+ * Lazily resolve the optional `@langchain/langgraph` peer dependency.
  *
- * LangGraph JS does not yet expose `awrapToolCall` on `ToolNode`; this wrapper provides the
- * same interceptor boundary as Python's `ToolNode(..., awrap_tool_call=...)`.
+ * Importing this module must not require the peer to be installed, so the Paybond barrel
+ * can load for consumers of other frameworks. The peer is only needed when a guarded
+ * LangGraph `ToolNode` is actually constructed.
  */
-class PaybondGuardedToolNode extends ToolNode {
-    awrap;
-    constructor(tools, run, options) {
-        super(tools, options);
-        this.awrap = paybondAwrapToolCall(run);
-    }
-    async runTool(call, config, state) {
-        const request = {
-            tool_call: {
-                name: call.name,
-                id: call.id,
-                args: (call.args ?? {}),
-            },
-        };
-        const execute = async (req) => super.runTool({
-            ...call,
-            name: req.tool_call.name,
-            id: req.tool_call.id ?? call.id,
-            args: req.tool_call.args ?? call.args,
-        }, config, state);
-        const result = await this.awrap(request, execute);
-        return normalizeLangGraphHookResult(call, result);
+function loadLangGraphPrebuilt() {
+    if (cachedPrebuilt === undefined) {
+        try {
+            const require = createRequire(import.meta.url);
+            cachedPrebuilt = require("@langchain/langgraph/prebuilt");
+        }
+        catch (err) {
+            throw new Error('The LangGraph integration requires the optional peer dependencies "@langchain/core" and "@langchain/langgraph"; install them with: npm install @langchain/core @langchain/langgraph', { cause: err });
+        }
     }
+    return cachedPrebuilt;
 }
 /**
  * Convenience factory: `ToolNode` with Paybond spend guard + auto-evidence on every tool call.
+ *
+ * LangGraph JS does not yet expose `awrapToolCall` on `ToolNode`; the returned subclass provides
+ * the same interceptor boundary as Python's `ToolNode(..., awrap_tool_call=...)`.
  */
 export function paybondToolNode(tools, run, options) {
+    const { ToolNode: ToolNodeCtor } = loadLangGraphPrebuilt();
+    class PaybondGuardedToolNode extends ToolNodeCtor {
+        awrap;
+        constructor(guardedTools, guardedRun, guardedOptions) {
+            super(guardedTools, guardedOptions);
+            this.awrap = paybondAwrapToolCall(guardedRun);
+        }
+        async runTool(call, config, state) {
+            const request = {
+                tool_call: {
+                    name: call.name,
+                    id: call.id,
+                    args: (call.args ?? {}),
+                },
+            };
+            const execute = async (req) => super.runTool({
+                ...call,
+                name: req.tool_call.name,
+                id: req.tool_call.id ?? call.id,
+                args: req.tool_call.args ?? call.args,
+            }, config, state);
+            const result = await this.awrap(request, execute);
+            return normalizeLangGraphHookResult(call, result);
+        }
+    }
     return new PaybondGuardedToolNode(tools, run, options);
 }

package/dist/mcp-server.js

@@ -13,7 +13,7 @@ import { McpCapabilityTokenCache, mcpToolStoresCapabilityToken, parseMcpCapabili
 import { createMcpPolicyGatewayAdapter, McpPolicyReloadGate, parseMcpPolicyReloadConfig, } from "./mcp-policy-reload.js";
 import { DEFAULT_PAYBOND_GATEWAY_BASE_URL, GatewayFraudClient, GatewaySignalClient, } from "./index.js";
 const SERVER_NAME = "Paybond MCP";
-const SERVER_VERSION = "0.11.1";
+const SERVER_VERSION = "0.11.3";
 const MCP_PROTOCOL_VERSION = "2025-11-25";
 const DEFAULT_PRINCIPAL_PATH = "/v1/auth/principal";
 const DEFAULT_RECOGNITION_VERIFIER_ID = "paybond-gateway";

package/dist/openai-agents/index.d.ts

@@ -1,4 +1,4 @@
-import { ToolGuardrailFunctionOutputFactory, type FunctionTool, type RunConfig, type ToolInputGuardrailDefinition } from "@openai/agents";
+import type { FunctionTool, RunConfig, ToolInputGuardrailDefinition } from "@openai/agents";
 import { type PaybondAgentRun, type PaybondToolInputGuardDecision } from "../agent/index.js";
 export type PaybondOpenAIAgentsAdapterOptions = {
     /**
@@ -11,7 +11,7 @@ declare function isFunctionTool(value: unknown): value is FunctionTool;
 /** Detect OpenAI Agents SDK function tools (`type: "function"`). */
 export { isFunctionTool as isOpenAIFunctionTool };
 /** Map a framework-neutral Paybond decision to OpenAI tool guardrail output. */
-export declare function mapPaybondDecisionToOpenAIToolGuardrail(decision: PaybondToolInputGuardDecision): ReturnType<typeof ToolGuardrailFunctionOutputFactory.allow>;
+export declare function mapPaybondDecisionToOpenAIToolGuardrail(decision: PaybondToolInputGuardDecision): ReturnType<typeof import("@openai/agents").ToolGuardrailFunctionOutputFactory.allow>;
 /** RunConfig fragment enabling Paybond verify before OpenAI approval interruptions. */
 export declare const paybondOpenAIAgentsRunConfig: Pick<RunConfig, "toolExecution">;
 /** Translate Paybond middleware into OpenAI Agents SDK tool input guardrails. */

package/dist/openai-agents/index.js

@@ -1,5 +1,25 @@
-import { defineToolInputGuardrail, ToolGuardrailFunctionOutputFactory, } from "@openai/agents";
+import { createRequire } from "node:module";
 import { createToolInputGuardAdapter, } from "../agent/index.js";
+let cachedOpenAIAgents;
+/**
+ * Lazily resolve the optional `@openai/agents` peer dependency.
+ *
+ * Importing this module must not require the peer to be installed, so consumers of
+ * other frameworks (LangGraph, Vercel AI, etc.) can load the Paybond barrel without it.
+ * The peer is only needed when the OpenAI Agents adapter functions actually run.
+ */
+function loadOpenAIAgents() {
+    if (cachedOpenAIAgents === undefined) {
+        try {
+            const require = createRequire(import.meta.url);
+            cachedOpenAIAgents = require("@openai/agents");
+        }
+        catch (err) {
+            throw new Error('The OpenAI Agents integration requires the optional peer dependency "@openai/agents"; install it with: npm install @openai/agents', { cause: err });
+        }
+    }
+    return cachedOpenAIAgents;
+}
 function parseToolArguments(raw) {
     if (!raw.trim()) {
         return {};
@@ -17,6 +37,7 @@ function isFunctionTool(value) {
 export { isFunctionTool as isOpenAIFunctionTool };
 /** Map a framework-neutral Paybond decision to OpenAI tool guardrail output. */
 export function mapPaybondDecisionToOpenAIToolGuardrail(decision) {
+    const { ToolGuardrailFunctionOutputFactory } = loadOpenAIAgents();
     if (decision.kind === "allow") {
         return ToolGuardrailFunctionOutputFactory.allow({
             paybond: {
@@ -37,6 +58,7 @@ export function mapPaybondDecisionToOpenAIToolGuardrail(decision) {
     });
 }
 function buildPaybondInputGuardrail(run, toolName) {
+    const { defineToolInputGuardrail } = loadOpenAIAgents();
     const guard = createToolInputGuardAdapter(run);
     return defineToolInputGuardrail({
         name: `paybond_spend_${toolName}`,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@paybond/kit",
-  "version": "0.11.1",
+  "version": "0.11.3",
   "mcpName": "io.github.nonameuserd/paybond",
   "description": "Paybond Kit for TypeScript: agent spend governance for paid tool calls with spend authorization, evidence receipts, refunds, disputes, hosted Gateway sessions, and settlement.",
   "license": "Apache-2.0",
@@ -53,6 +53,7 @@
   },
   "files": [
     "dist",
+    "policy",
     "completion-presets",
     "solutions",
     "templates",
@@ -109,7 +110,7 @@
   },
   "scripts": {
     "clean": "node ./scripts/clean-dist.mjs",
-    "build": "npm run clean && tsc -p tsconfig.json && node ../scripts/sync-completion-catalog.mjs && node ../scripts/sync-dev-trace-ui.mjs && node ./scripts/generate-templates.mjs",
+    "build": "npm run clean && tsc -p tsconfig.json && node ../scripts/sync-completion-catalog.mjs && node ../scripts/sync-policy-presets.mjs && node ../scripts/sync-dev-trace-ui.mjs && node ./scripts/generate-templates.mjs",
     "cli": "node dist/cli.js",
     "cli:dev": "npm run build --silent && node dist/cli.js",
     "generate:cli-contract": "node ../cli-parity/generate.mjs",
@@ -150,6 +151,7 @@
     "@noble/ed25519": "^2.2.1",
     "@noble/hashes": "^1.7.1",
     "@noble/secp256k1": "^2.2.3",
+    "ajv": "^8.17.1",
     "blake3": "^2.1.7",
     "uuid": "^14.0.0"
   },
@@ -161,7 +163,6 @@
     "@openai/agents": "^0.12.0",
     "@types/node": "^22.10.0",
     "ai": "^7.0.4",
-    "ajv": "^8.17.1",
     "typescript": "^5.7.2",
     "vitest": "^4.1.8",
     "zod": "^4.4.3"

package/policy/presets/aws.yaml

@@ -0,0 +1,19 @@
+version: 1
+name: aws-operator-v1
+default_deny: true
+
+tools:
+  aws.ec2.start_instance:
+    side_effecting: true
+    max_spend_cents: 50000
+    evidence_preset: cost_and_completion
+
+  aws.ec2.describe_instances:
+    side_effecting: false
+
+intent:
+  allowed_tools:
+    - aws.ec2.start_instance
+  budget:
+    currency: usd
+    max_spend_usd: 500

package/policy/presets/domain/aws.yaml

@@ -0,0 +1,15 @@
+version: 1
+name: aws-operator-v1
+default_deny: true
+
+tools:
+  aws.ec2.start_instance:
+    side_effecting: true
+    evidence_preset: cost_and_completion
+
+  aws.ec2.describe_instances:
+    side_effecting: false
+
+intent:
+  allowed_tools:
+    - aws.ec2.start_instance

package/policy/presets/domain/saas.yaml

@@ -0,0 +1,15 @@
+version: 1
+name: saas-agent-v1
+default_deny: true
+
+tools:
+  saas.provision_seat:
+    side_effecting: true
+    evidence_preset: cost_and_completion
+
+  saas.list_plans:
+    side_effecting: false
+
+intent:
+  allowed_tools:
+    - saas.provision_seat

package/policy/presets/domain/shopping.yaml

@@ -0,0 +1,15 @@
+version: 1
+name: shopping-agent-v1
+default_deny: true
+
+tools:
+  commerce.checkout:
+    side_effecting: true
+    evidence_preset: cost_and_completion
+
+  search.products:
+    side_effecting: false
+
+intent:
+  allowed_tools:
+    - commerce.checkout

package/policy/presets/domain/travel.yaml

@@ -0,0 +1,15 @@
+version: 1
+name: travel-agent-v1
+default_deny: true
+
+tools:
+  travel.book_hotel:
+    side_effecting: true
+    evidence_preset: cost_and_completion
+
+  search.web:
+    side_effecting: false
+
+intent:
+  allowed_tools:
+    - travel.book_hotel

package/policy/presets/guardrails/default-aws.yaml

@@ -0,0 +1,8 @@
+tools:
+  aws.ec2.start_instance:
+    max_spend_cents: 50000
+
+intent:
+  budget:
+    currency: usd
+    max_spend_usd: 500

package/policy/presets/guardrails/default-saas.yaml

@@ -0,0 +1,8 @@
+tools:
+  saas.provision_seat:
+    max_spend_cents: 5000
+
+intent:
+  budget:
+    currency: usd
+    max_spend_usd: 50

package/policy/presets/guardrails/default-shopping.yaml

@@ -0,0 +1,8 @@
+tools:
+  commerce.checkout:
+    max_spend_cents: 10000
+
+intent:
+  budget:
+    currency: usd
+    max_spend_usd: 100

package/policy/presets/guardrails/default-travel.yaml

@@ -0,0 +1,8 @@
+tools:
+  travel.book_hotel:
+    max_spend_cents: 20000
+
+intent:
+  budget:
+    currency: usd
+    max_spend_usd: 200

package/policy/presets/read-only.yaml

@@ -0,0 +1,23 @@
+version: 1
+name: read-only-agent-v1
+default_deny: true
+
+tools:
+  search.web:
+    side_effecting: false
+
+  search.products:
+    side_effecting: false
+
+  saas.list_plans:
+    side_effecting: false
+
+  aws.ec2.describe_instances:
+    side_effecting: false
+
+intent:
+  allowed_tools:
+    - search.web
+    - search.products
+    - saas.list_plans
+    - aws.ec2.describe_instances

package/policy/presets/saas.yaml

@@ -0,0 +1,19 @@
+version: 1
+name: saas-agent-v1
+default_deny: true
+
+tools:
+  saas.provision_seat:
+    side_effecting: true
+    max_spend_cents: 5000
+    evidence_preset: cost_and_completion
+
+  saas.list_plans:
+    side_effecting: false
+
+intent:
+  allowed_tools:
+    - saas.provision_seat
+  budget:
+    currency: usd
+    max_spend_usd: 50

package/policy/presets/shopping.yaml

@@ -0,0 +1,19 @@
+version: 1
+name: shopping-agent-v1
+default_deny: true
+
+tools:
+  commerce.checkout:
+    side_effecting: true
+    max_spend_cents: 10000
+    evidence_preset: cost_and_completion
+
+  search.products:
+    side_effecting: false
+
+intent:
+  allowed_tools:
+    - commerce.checkout
+  budget:
+    currency: usd
+    max_spend_usd: 100

package/policy/presets/strict.yaml

@@ -0,0 +1,16 @@
+version: 1
+name: strict-agent-v1
+default_deny: true
+
+tools:
+  travel.book_hotel:
+    side_effecting: true
+    max_spend_cents: 1000
+    evidence_preset: cost_and_completion
+
+intent:
+  allowed_tools:
+    - travel.book_hotel
+  budget:
+    currency: usd
+    max_spend_usd: 10

package/policy/presets/travel.yaml

@@ -0,0 +1,19 @@
+version: 1
+name: travel-agent-v1
+default_deny: true
+
+tools:
+  travel.book_hotel:
+    side_effecting: true
+    max_spend_cents: 20000
+    evidence_preset: cost_and_completion
+
+  search.web:
+    side_effecting: false
+
+intent:
+  allowed_tools:
+    - travel.book_hotel
+  budget:
+    currency: usd
+    max_spend_usd: 200