agentpolicypack 0.1.0a1__tar.gz

agentpolicypack-0.1.0a1/.gitignore

@@ -0,0 +1,18 @@
+.coverage
+.mypy_cache/
+.pytest_cache/
+.ruff_cache/
+__pycache__/
+*.py[cod]
+dist/
+build/
+*.egg-info/
+.venv/
+venv/
+.env
+*.sqlite
+*.db
+reports/*.json
+reports/*.csv
+reports/*.tmp
+

agentpolicypack-0.1.0a1/LICENSE

@@ -0,0 +1,22 @@
+MIT License
+
+Copyright (c) 2026 sekacorn
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+

agentpolicypack-0.1.0a1/PKG-INFO

@@ -0,0 +1,198 @@
+Metadata-Version: 2.4
+Name: agentpolicypack
+Version: 0.1.0a1
+Summary: A vendor-neutral policy-as-code toolkit for governing AI agents and agentic workflows.
+Project-URL: Homepage, https://github.com/sekacorn/AgentPolicyPack
+Project-URL: Repository, https://github.com/sekacorn/AgentPolicyPack
+Project-URL: Issues, https://github.com/sekacorn/AgentPolicyPack/issues
+Project-URL: Documentation, https://github.com/sekacorn/AgentPolicyPack/tree/main/docs
+Author: sekacorn
+License: MIT
+License-File: LICENSE
+Classifier: Development Status :: 3 - Alpha
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Security
+Classifier: Topic :: Software Development :: Libraries :: Python Modules
+Classifier: Typing :: Typed
+Requires-Python: <3.14,>=3.11
+Requires-Dist: packaging>=24.0
+Requires-Dist: pydantic>=2.7
+Requires-Dist: pyyaml>=6.0.1
+Requires-Dist: typer>=0.12
+Provides-Extra: dev
+Requires-Dist: bandit[toml]>=1.7.9; extra == 'dev'
+Requires-Dist: build>=1.2; extra == 'dev'
+Requires-Dist: mypy>=1.10; extra == 'dev'
+Requires-Dist: pip-audit>=2.7; extra == 'dev'
+Requires-Dist: pytest-cov>=5.0; extra == 'dev'
+Requires-Dist: pytest>=9.0.3; extra == 'dev'
+Requires-Dist: ruff>=0.5; extra == 'dev'
+Requires-Dist: twine>=5.1; extra == 'dev'
+Requires-Dist: types-pyyaml>=6.0.12; extra == 'dev'
+Description-Content-Type: text/markdown
+
+# AgentPolicyPack
+
+AgentPolicyPack lets organizations define, test, and carry AI-agent governance rules across models, frameworks, providers, and deployment environments.
+
+AgentPolicyPack is an alpha project. Version `0.1.0a1` is ready for public alpha release with documented limitations, not production certification.
+
+## Motivation
+
+AI-agent governance should be portable, deterministic, auditable, version-controlled, and testable in CI. AgentPolicyPack provides a vendor-neutral policy bundle format, a fail-closed evaluator, policy tests, simulation, diffing, and a Python API plus CLI.
+
+## Problem Statement
+
+Organizations often encode agent rules inside one model provider, framework, runtime, or deployment stack. That creates lock-in and makes policy behavior hard to test. AgentPolicyPack separates governance intent from enforcement systems so the same rules can be validated, compared, and evaluated offline.
+
+## Core Capabilities
+
+- YAML and JSON policy bundles loaded with safe parsers.
+- Strict schema models that reject unknown fields.
+- Structural and semantic validation with stable finding codes.
+- Safe structured condition language with bounded nesting.
+- Target matching for subjects, actions, resources, tools, models, providers, and environments.
+- Conflict strategies: `deny_overrides`, `allow_overrides`, `first_applicable`, `highest_priority`, and `only_one_applicable`.
+- Effects: `allow`, `deny`, `require_review`, `limit`, `redact`, and `log_only`.
+- Obligations and most-restrictive limit aggregation.
+- Deterministic normalization, digests, decision IDs, and reports.
+- Embedded policy tests, policy-test coverage, simulation, comparison, and conservative diffing.
+
+## Architecture
+
+Policy bundles load into typed Pydantic models. Validation runs before evaluation. Invalid bundles fail closed as `indeterminate` with a deny-equivalent effective decision. The evaluator performs deterministic target matching, structured condition evaluation, conflict resolution, obligation aggregation, limit aggregation, and evidence generation. External systems remain responsible for enforcing the returned decision.
+
+## Installation
+
+```powershell
+python -m pip install agentpolicypack
+```
+
+For development:
+
+```powershell
+python -m pip install -e ".[dev]"
+```
+
+## Quick Start Policy
+
+```yaml
+schema_version: "1.0"
+bundle:
+  id: customer-support-governance
+  name: Customer Support Agent Governance
+  version: "1.0.0"
+  namespace: example.customer_support
+  default_decision: deny
+  conflict_strategy: deny_overrides
+policies:
+  - id: allow-ticket-read
+    effect: allow
+    priority: 100
+    targets:
+      subjects:
+        roles: [support_agent]
+      actions: [ticket.read]
+      resources:
+        types: [SupportTicket]
+    conditions:
+      all:
+        - field: resource.attributes.assigned_agent_id
+          operator: equals
+          value_from: subject.id
+```
+
+## Evaluation Example
+
+```powershell
+agentpolicy evaluate examples/tool_governance/policy.yaml --request examples/tool_governance/allow-search-request.yaml
+```
+
+## Policy-Test Example
+
+```powershell
+agentpolicy test examples/tool_governance/policy.yaml
+agentpolicy coverage examples/tool_governance/policy.yaml
+```
+
+## CLI Examples
+
+```powershell
+agentpolicy validate examples/tool_governance/policy.yaml
+agentpolicy lint examples/tool_governance/policy.yaml
+agentpolicy inspect examples/tool_governance/policy.yaml
+agentpolicy normalize examples/tool_governance/policy.yaml
+agentpolicy digest examples/tool_governance/policy.yaml
+agentpolicy simulate examples/tool_governance/policy.yaml --requests examples/tool_governance/requests.yaml
+agentpolicy diff tests/fixtures/diff/policy-v1.yaml tests/fixtures/diff/policy-v2.yaml
+agentpolicy compare tests/fixtures/diff/policy-v1.yaml tests/fixtures/diff/policy-v2.yaml --requests tests/fixtures/diff/requests.yaml
+```
+
+## Python API Example
+
+```python
+from agent_policy_pack import DecisionRequest, evaluate, load_bundle
+
+bundle = load_bundle("examples/tool_governance/policy.yaml")
+request = DecisionRequest(action="tool.call", subject={"roles": ["research_agent"]})
+decision = evaluate(bundle, request)
+print(decision.decision, decision.effective_decision)
+```
+
+## Conflict Strategies
+
+`deny_overrides` is the default. Any matching deny controls before review or allow. `allow_overrides` is supported but dangerous because it may relax denies. `first_applicable` uses deterministic priority-descending, ID-ascending order. `highest_priority` selects the highest priority and resolves equal-priority mixed effects conservatively. `only_one_applicable` returns `indeterminate` when multiple policies match.
+
+## Effects, Obligations, and Limits
+
+Policy effects express governance intent. Decisions expose a primary outcome plus structured obligations such as `audit`, `redact`, `mask`, `require_review`, `enforce_limit`, `notify`, `retain_evidence`, and `attach_policy_context`. Custom obligations must use an extension namespace and are preserved, not executed. Limits use exact `Decimal` handling for costs.
+
+## Simulation and Diffing
+
+Simulation evaluates request batches offline. Comparison evaluates two bundles against the same requests. Diffing classifies changes conservatively as security relaxation, tightening, potentially breaking, or informational.
+
+## Integration Roadmap
+
+The package includes protocol types for future adapters. Version `0.1.0a1` works independently and offline. Forge, PrivateAIStack, ModelSwapBench, OpenOntologyLite, AIAuditLog, and OpenAIMeter integrations are deferred unless optional adapters are installed and tested in later releases.
+
+## Security Model
+
+AgentPolicyPack uses safe YAML loading, strict unknown-field rejection, bounded condition nesting, safe glob-style patterns, deterministic serialization, and fail-closed defaults. It never uses Python `eval` or `exec`, never imports modules named by policy files, and never follows remote URLs.
+
+## Limitations
+
+- External systems must enforce policy decisions.
+- No identity-provider integration.
+- No secrets management.
+- No network firewall.
+- No operating-system sandbox.
+- No hosted policy server.
+- No graphical editor.
+- No general-purpose expression language.
+- No arbitrary code execution.
+- No legal or regulatory certification.
+- Custom obligations are preserved but not executed.
+- PII obligations do not provide automatic perfect PII discovery.
+- Policies cannot guarantee model behavior.
+- Optional framework adapters may cover only documented integration points.
+- Policy diff classification is conservative and rule-based.
+- Policy-test coverage is not software-code coverage.
+- Bundle format may evolve before version 1.0.
+
+## Contributing
+
+Use the development commands in `docs/development.md`. Keep behavior deterministic, typed, local-first, and fail-closed.
+
+## License
+
+MIT.
+
+## Author
+
+sekacorn
+

agentpolicypack-0.1.0a1/README.md

@@ -0,0 +1,160 @@
+# AgentPolicyPack
+
+AgentPolicyPack lets organizations define, test, and carry AI-agent governance rules across models, frameworks, providers, and deployment environments.
+
+AgentPolicyPack is an alpha project. Version `0.1.0a1` is ready for public alpha release with documented limitations, not production certification.
+
+## Motivation
+
+AI-agent governance should be portable, deterministic, auditable, version-controlled, and testable in CI. AgentPolicyPack provides a vendor-neutral policy bundle format, a fail-closed evaluator, policy tests, simulation, diffing, and a Python API plus CLI.
+
+## Problem Statement
+
+Organizations often encode agent rules inside one model provider, framework, runtime, or deployment stack. That creates lock-in and makes policy behavior hard to test. AgentPolicyPack separates governance intent from enforcement systems so the same rules can be validated, compared, and evaluated offline.
+
+## Core Capabilities
+
+- YAML and JSON policy bundles loaded with safe parsers.
+- Strict schema models that reject unknown fields.
+- Structural and semantic validation with stable finding codes.
+- Safe structured condition language with bounded nesting.
+- Target matching for subjects, actions, resources, tools, models, providers, and environments.
+- Conflict strategies: `deny_overrides`, `allow_overrides`, `first_applicable`, `highest_priority`, and `only_one_applicable`.
+- Effects: `allow`, `deny`, `require_review`, `limit`, `redact`, and `log_only`.
+- Obligations and most-restrictive limit aggregation.
+- Deterministic normalization, digests, decision IDs, and reports.
+- Embedded policy tests, policy-test coverage, simulation, comparison, and conservative diffing.
+
+## Architecture
+
+Policy bundles load into typed Pydantic models. Validation runs before evaluation. Invalid bundles fail closed as `indeterminate` with a deny-equivalent effective decision. The evaluator performs deterministic target matching, structured condition evaluation, conflict resolution, obligation aggregation, limit aggregation, and evidence generation. External systems remain responsible for enforcing the returned decision.
+
+## Installation
+
+```powershell
+python -m pip install agentpolicypack
+```
+
+For development:
+
+```powershell
+python -m pip install -e ".[dev]"
+```
+
+## Quick Start Policy
+
+```yaml
+schema_version: "1.0"
+bundle:
+  id: customer-support-governance
+  name: Customer Support Agent Governance
+  version: "1.0.0"
+  namespace: example.customer_support
+  default_decision: deny
+  conflict_strategy: deny_overrides
+policies:
+  - id: allow-ticket-read
+    effect: allow
+    priority: 100
+    targets:
+      subjects:
+        roles: [support_agent]
+      actions: [ticket.read]
+      resources:
+        types: [SupportTicket]
+    conditions:
+      all:
+        - field: resource.attributes.assigned_agent_id
+          operator: equals
+          value_from: subject.id
+```
+
+## Evaluation Example
+
+```powershell
+agentpolicy evaluate examples/tool_governance/policy.yaml --request examples/tool_governance/allow-search-request.yaml
+```
+
+## Policy-Test Example
+
+```powershell
+agentpolicy test examples/tool_governance/policy.yaml
+agentpolicy coverage examples/tool_governance/policy.yaml
+```
+
+## CLI Examples
+
+```powershell
+agentpolicy validate examples/tool_governance/policy.yaml
+agentpolicy lint examples/tool_governance/policy.yaml
+agentpolicy inspect examples/tool_governance/policy.yaml
+agentpolicy normalize examples/tool_governance/policy.yaml
+agentpolicy digest examples/tool_governance/policy.yaml
+agentpolicy simulate examples/tool_governance/policy.yaml --requests examples/tool_governance/requests.yaml
+agentpolicy diff tests/fixtures/diff/policy-v1.yaml tests/fixtures/diff/policy-v2.yaml
+agentpolicy compare tests/fixtures/diff/policy-v1.yaml tests/fixtures/diff/policy-v2.yaml --requests tests/fixtures/diff/requests.yaml
+```
+
+## Python API Example
+
+```python
+from agent_policy_pack import DecisionRequest, evaluate, load_bundle
+
+bundle = load_bundle("examples/tool_governance/policy.yaml")
+request = DecisionRequest(action="tool.call", subject={"roles": ["research_agent"]})
+decision = evaluate(bundle, request)
+print(decision.decision, decision.effective_decision)
+```
+
+## Conflict Strategies
+
+`deny_overrides` is the default. Any matching deny controls before review or allow. `allow_overrides` is supported but dangerous because it may relax denies. `first_applicable` uses deterministic priority-descending, ID-ascending order. `highest_priority` selects the highest priority and resolves equal-priority mixed effects conservatively. `only_one_applicable` returns `indeterminate` when multiple policies match.
+
+## Effects, Obligations, and Limits
+
+Policy effects express governance intent. Decisions expose a primary outcome plus structured obligations such as `audit`, `redact`, `mask`, `require_review`, `enforce_limit`, `notify`, `retain_evidence`, and `attach_policy_context`. Custom obligations must use an extension namespace and are preserved, not executed. Limits use exact `Decimal` handling for costs.
+
+## Simulation and Diffing
+
+Simulation evaluates request batches offline. Comparison evaluates two bundles against the same requests. Diffing classifies changes conservatively as security relaxation, tightening, potentially breaking, or informational.
+
+## Integration Roadmap
+
+The package includes protocol types for future adapters. Version `0.1.0a1` works independently and offline. Forge, PrivateAIStack, ModelSwapBench, OpenOntologyLite, AIAuditLog, and OpenAIMeter integrations are deferred unless optional adapters are installed and tested in later releases.
+
+## Security Model
+
+AgentPolicyPack uses safe YAML loading, strict unknown-field rejection, bounded condition nesting, safe glob-style patterns, deterministic serialization, and fail-closed defaults. It never uses Python `eval` or `exec`, never imports modules named by policy files, and never follows remote URLs.
+
+## Limitations
+
+- External systems must enforce policy decisions.
+- No identity-provider integration.
+- No secrets management.
+- No network firewall.
+- No operating-system sandbox.
+- No hosted policy server.
+- No graphical editor.
+- No general-purpose expression language.
+- No arbitrary code execution.
+- No legal or regulatory certification.
+- Custom obligations are preserved but not executed.
+- PII obligations do not provide automatic perfect PII discovery.
+- Policies cannot guarantee model behavior.
+- Optional framework adapters may cover only documented integration points.
+- Policy diff classification is conservative and rule-based.
+- Policy-test coverage is not software-code coverage.
+- Bundle format may evolve before version 1.0.
+
+## Contributing
+
+Use the development commands in `docs/development.md`. Keep behavior deterministic, typed, local-first, and fail-closed.
+
+## License
+
+MIT.
+
+## Author
+
+sekacorn
+

agentpolicypack-0.1.0a1/docs/ci-security-notes.md

@@ -0,0 +1,6 @@
+# CI Security Notes
+
+Workflows use official stable action versions because exact verified commit SHAs were not established during local preparation. Human release review should pin each action to a verified commit SHA before enforcing a stricter supply-chain policy.
+
+The release workflow is prepared for PyPI Trusted Publishing through OIDC and the protected `pypi` environment. It does not use a PyPI API token.
+

agentpolicypack-0.1.0a1/docs/development.md

@@ -0,0 +1,18 @@
+# Development
+
+Use PowerShell-compatible commands:
+
+```powershell
+python -m pip install -e ".[dev]"
+python -m ruff check .
+python -m ruff format --check .
+python -m mypy --strict src
+python -m pytest
+python -m pytest --cov=agent_policy_pack --cov-branch
+python -m bandit -r src
+python -m pip_audit
+python -m build
+python -m twine check dist/*
+```
+
+Release publishing must use the GitHub release workflow with PyPI Trusted Publishing. Do not create a release tag until metadata, checks, artifacts, clean installs, CI, and the PyPI trusted publisher configuration are verified.

agentpolicypack-0.1.0a1/docs/index.md

@@ -0,0 +1,11 @@
+# AgentPolicyPack Documentation
+
+AgentPolicyPack is a local-first policy-as-code toolkit for governing AI agents and agentic workflows. It defines portable bundles, validates them, evaluates requests, produces evidence, runs policy tests, simulates batches, and compares bundles.
+
+See:
+
+- `policy-format.md` for the complete bundle reference.
+- `security.md` for the threat model and safe-input rules.
+- `development.md` for local verification commands.
+- `roadmap.md` for planned alpha work.
+

agentpolicypack-0.1.0a1/docs/policy-format.md

@@ -0,0 +1,20 @@
+# Policy Format Reference
+
+Bundles support YAML and JSON with `schema_version: "1.0"`. Top-level fields are `schema_version`, `bundle`, `data_classifications`, `policies`, and `tests`.
+
+`bundle` contains `id`, `name`, `version`, `namespace`, `description`, `default_decision`, `conflict_strategy`, `tags`, and explicit `metadata`.
+
+Policies contain `id`, `name`, `description`, `enabled`, `effect`, `priority`, `targets`, `conditions`, `obligations`, `limits`, `reason`, `tags`, and `metadata`.
+
+Targets may match subjects, actions, resources, tools, models, providers, and environments. Wildcards are glob-style and intentionally limited.
+
+Conditions are structured with `all`, `any`, `not`, or leaf conditions using `field`, `operator`, and either `value` or `value_from`. Operators are `equals`, `not_equals`, `in`, `not_in`, `contains`, `not_contains`, `exists`, `not_exists`, `starts_with`, `ends_with`, numeric comparisons, `between`, and `matches_safe_pattern`.
+
+Missing fields make ordinary conditions non-matching. Invalid bundles or unsafe ambiguity produce validation errors and evaluation fails closed.
+
+Decisions are `allow`, `deny`, `require_review`, or `indeterminate`. Indeterminate defaults to deny-equivalent behavior.
+
+Obligations include `audit`, `redact`, `mask`, `require_review`, `enforce_limit`, `notify`, `retain_evidence`, and `attach_policy_context`. Extension obligations must contain a namespace such as `example.custom_obligation`.
+
+Limits include cost, token, tool-call, retry, and agent-step limits. Cost values are handled with `Decimal`, not binary floating point.
+

agentpolicypack-0.1.0a1/docs/roadmap.md

@@ -0,0 +1,29 @@
+# Roadmap
+
+## 0.1.0a2
+
+- Stronger policy shadowing analysis.
+- Aliases and renamed policy tracking.
+- Improved security-relaxation diff confidence.
+- Signed bundle manifests.
+- Configurable organizational lint profiles.
+- Richer test data generators.
+
+## 0.1.0a3
+
+- Deeper Forge middleware.
+- OpenOntologyLite reference validation.
+- ModelSwapBench compliance benchmark adapter.
+- PrivateAIStack integration examples.
+- Audit-event export for AIAuditLog.
+
+## 0.2
+
+- Policy package imports.
+- Namespaced reusable policy modules.
+- Local policy catalog.
+- Optional decision cache.
+- Policy provenance.
+- Signed release bundles.
+- Organization-level policy layering.
+

agentpolicypack-0.1.0a1/docs/security.md

@@ -0,0 +1,10 @@
+# Security and Threat Model
+
+AgentPolicyPack treats policy files as untrusted input. It uses safe YAML loading, duplicate-key checks, JSON parsing, UTF-8 validation, file-size limits, strict models, bounded condition nesting, and restricted safe glob patterns.
+
+The evaluator does not execute code, does not import policy-named modules, does not use `eval` or `exec`, and does not make network calls during evaluation.
+
+Security decision failures are fail-closed. Invalid bundles evaluate to `indeterminate` with a deny-equivalent effective decision by default.
+
+Out of scope: identity provider behavior, secrets management, network firewalling, operating-system sandboxing, hosted policy serving, legal certification, and perfect PII discovery.
+

agentpolicypack-0.1.0a1/examples/tool_governance/allow-search-request.yaml

@@ -0,0 +1,28 @@
+subject:
+  id: agent-1
+  type: ai_agent
+  roles:
+    - research_agent
+action: tool.call
+resource:
+  id: web
+  type: WebSearch
+  attributes:
+    classification: public
+tool:
+  name: search
+  namespace: external.web
+  risk: low
+  capabilities:
+    - search
+model:
+  provider: ollama
+  name: qwen2.5:3b
+  hosting: local
+environment:
+  name: production
+context:
+  request_id: req-001
+  estimated_cost_usd: "0.01"
+  tool_calls: 1
+

agentpolicypack-0.1.0a1/examples/tool_governance/policy.yaml

@@ -0,0 +1,147 @@
+schema_version: "1.0"
+bundle:
+  id: tool-governance
+  name: Tool Governance Example
+  version: "1.0.0"
+  namespace: example.tool_governance
+  description: Example policies for AI-agent tool use.
+  default_decision: deny
+  conflict_strategy: deny_overrides
+  tags:
+    - example
+    - tools
+data_classifications:
+  - public
+  - internal
+  - confidential
+  - restricted
+policies:
+  - id: deny-shell
+    name: Deny shell execution
+    enabled: true
+    effect: deny
+    priority: 300
+    targets:
+      tools:
+        names:
+          - shell
+      actions:
+        - tool.call
+    obligations:
+      - type: audit
+        parameters:
+          level: detailed
+    reason: Shell execution is prohibited by default.
+  - id: require-review-database-write
+    name: Require review for database writes
+    effect: require_review
+    priority: 250
+    targets:
+      tools:
+        capabilities:
+          - database_write
+      actions:
+        - tool.call
+      environments:
+        names:
+          - production
+    obligations:
+      - type: require_review
+        parameters:
+          reviewer_role: data_steward
+          timeout_behavior: deny
+    reason: Production database writes require human review.
+  - id: allow-research-search
+    name: Allow research agents to use search
+    effect: allow
+    priority: 100
+    targets:
+      subjects:
+        roles:
+          - research_agent
+      tools:
+        names:
+          - search
+        risks:
+          - low
+      actions:
+        - tool.call
+      environments:
+        names:
+          - development
+          - production
+    conditions:
+      all:
+        - field: resource.attributes.classification
+          operator: in
+          value:
+            - public
+            - internal
+        - field: context.estimated_cost_usd
+          operator: less_than_or_equal
+          value: "0.05"
+    obligations:
+      - type: audit
+        parameters:
+          level: standard
+    limits:
+      max_cost_usd: "0.05"
+      max_tool_calls: 5
+    reason: Low-risk search is allowed for research agents using non-sensitive data.
+tests:
+  - id: allow-search
+    name: Search request is allowed
+    request:
+      subject:
+        id: agent-1
+        type: ai_agent
+        roles:
+          - research_agent
+      action: tool.call
+      resource:
+        id: web
+        type: WebSearch
+        attributes:
+          classification: public
+      tool:
+        name: search
+        namespace: external.web
+        risk: low
+        capabilities:
+          - search
+      environment:
+        name: production
+      context:
+        estimated_cost_usd: "0.01"
+        tool_calls: 1
+    expect_decision: allow
+    expect_obligations:
+      - audit
+    expect_matched_policies:
+      - allow-research-search
+  - id: deny-shell
+    request:
+      subject:
+        id: agent-2
+        type: ai_agent
+        roles:
+          - research_agent
+      action: tool.call
+      resource:
+        id: terminal
+        type: Shell
+        attributes:
+          classification: internal
+      tool:
+        name: shell
+        risk: high
+        capabilities:
+          - command_execute
+      environment:
+        name: production
+      context:
+        estimated_cost_usd: "0.00"
+    expect_decision: deny
+    expect_matched_policies:
+      - deny-shell
+