asp-iam 0.1.0__tar.gz

asp_iam-0.1.0/.github/workflows/ci.yml

@@ -0,0 +1,34 @@
+name: ci
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        python: ["3.10", "3.11", "3.12", "3.13"]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v6
+        with:
+          python-version: ${{ matrix.python }}
+      - run: uv sync
+      - run: uv run ruff check .
+      - run: uv run pytest -q
+
+  terraform:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v6
+      - uses: hashicorp/setup-terraform@v3
+      - run: uv sync
+      - name: Generate a policy as Terraform
+        run: uv run python examples/terraform_output.py
+      - name: Terraform says the file is valid
+        working-directory: examples/out
+        run: terraform init -backend=false && terraform validate

asp_iam-0.1.0/.github/workflows/release.yml

@@ -0,0 +1,31 @@
+name: release
+
+# Push a version tag to publish:  git tag v0.1.0 && git push origin v0.1.0
+on:
+  push:
+    tags: ["v*"]
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    environment: pypi          # must match the "trusted publisher" set up on pypi.org
+    permissions:
+      id-token: write          # lets PyPI verify this workflow; no password or token stored
+      contents: write          # to create the GitHub Release
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v6
+      - name: Tag must match the version in pyproject.toml
+        run: |
+          VERSION=$(grep -m1 '^version' pyproject.toml | cut -d'"' -f2)
+          test "v$VERSION" = "${{ github.ref_name }}" || { echo "tag ${{ github.ref_name }} != v$VERSION"; exit 1; }
+      - run: uv sync
+      - name: Tests must pass before anything is published
+        run: uv run pytest -q
+      - run: uv build
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+      - name: Create GitHub Release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: gh release create "${{ github.ref_name }}" dist/* --notes-file CHANGELOG.md

asp_iam-0.1.0/.gitignore

@@ -0,0 +1,8 @@
+.venv/
+__pycache__/
+*.pyc
+.pytest_cache/
+.ruff_cache/
+dist/
+.DS_Store
+examples/out/

asp_iam-0.1.0/.python-version

@@ -0,0 +1 @@
+3.11

asp_iam-0.1.0/CHANGELOG.md

@@ -0,0 +1,12 @@
+# Changelog
+
+## 0.1.0 (first release)
+
+- `record()`: record every AWS call made through boto3 (`with` block or decorator)
+- correct IAM action names where API and IAM names differ (`mappings.py`)
+- policies scoped to the exact S3 buckets, DynamoDB tables/indexes, SQS queues, SNS topics and Lambda functions used
+- `rec.terraform()`: the policy as a Terraform `aws_iam_policy`
+- `rec.check(policy)`: missing / unused / too-broad permissions in an existing policy
+- `rec.explain()`: the policy in plain English
+- pytest plugin: `pytest --asp`, `pytest --asp-check role.json`
+- example: an AI agent with AWS tools gets a least-privilege policy

asp_iam-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Kxvya18
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

asp_iam-0.1.0/PKG-INFO

@@ -0,0 +1,154 @@
+Metadata-Version: 2.5
+Name: asp-iam
+Version: 0.1.0
+Summary: Agent Scoped Permissions: record the AWS calls your code (or AI agent) makes and get the least-privilege IAM policy
+Project-URL: Homepage, https://github.com/Kxvya18/asp
+Project-URL: Issues, https://github.com/Kxvya18/asp/issues
+Project-URL: Changelog, https://github.com/Kxvya18/asp/blob/main/CHANGELOG.md
+Author: Kxvya18
+License-Expression: MIT
+License-File: LICENSE
+Keywords: ai-agents,aws,boto3,devsecops,iam,least-privilege,security
+Classifier: Development Status :: 3 - Alpha
+Classifier: Framework :: Pytest
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Security
+Classifier: Topic :: System :: Systems Administration
+Requires-Python: >=3.10
+Requires-Dist: boto3>=1.26
+Description-Content-Type: text/markdown
+
+# asp: Agent Scoped Permissions
+
+[![ci](https://github.com/Kxvya18/asp/actions/workflows/ci.yml/badge.svg)](https://github.com/Kxvya18/asp/actions/workflows/ci.yml)
+[![PyPI](https://img.shields.io/pypi/v/asp-iam)](https://pypi.org/project/asp-iam/)
+[![Python](https://img.shields.io/pypi/pyversions/asp-iam)](https://pypi.org/project/asp-iam/)
+[![License: MIT](https://img.shields.io/badge/license-MIT-blue)](LICENSE)
+
+Record the AWS calls your Python code, or your **AI agent**, actually makes, and get the
+**least-privilege IAM policy** for it.
+
+```python
+from asp import record
+
+with record() as rec:
+    run_my_script()            # or: agent.run("archive last month's reports")
+
+print(rec.policy_json())
+```
+
+```json
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {"Effect": "Allow", "Action": ["s3:GetObject"], "Resource": "arn:aws:s3:::reports/*"},
+    {"Effect": "Allow", "Action": ["s3:PutObject"], "Resource": "arn:aws:s3:::archive/*"}
+  ]
+}
+```
+It only reads from `reports` and only writes to `archive`, because that's all the code did.
+
+## Why
+AI agents and scripts are often given broad AWS permissions because nobody knows what they
+really need. `asp` watches what they actually do and writes the smallest policy that allows it.
+It works offline with [moto](https://github.com/getmoto/moto), so it fits in your tests.
+
+## Install
+```bash
+pip install asp-iam
+```
+
+## Use
+```python
+from asp import record
+
+# as a block
+with record() as rec:
+    ...
+rec.actions()       # ['dynamodb:PutItem', 's3:GetObject']
+rec.policy()        # dict
+rec.save("policy.json")
+rec.terraform()     # the same policy as a Terraform resource
+
+# as a decorator
+@record(save_to="policy.json")
+def nightly_job():
+    ...
+```
+
+## Correct permission names
+Python call names aren't always permission names: `list_objects_v2` needs `s3:ListBucket`,
+`copy_object` needs `s3:GetObject` + `s3:PutObject`, CloudWatch calls need `cloudwatch:*`,
+Bedrock's `Converse` needs `bedrock:InvokeModel`. These exceptions live in one readable table,
+[`mappings.py`](src/asp/mappings.py). Found a missing one? Add a row and a test.
+
+## AI agents: give them only what they use
+[`examples/ai_agent.py`](examples/ai_agent.py) gives an agent three AWS tools (list, read, write
+files) and the task *"summarise the October report and save it to the archive"*. Recorded with asp:
+
+```
+The agent needed only this:
+- read files in bucket 'reports'
+- list files in bucket 'reports'
+- write files in bucket 'archive'
+```
+Instead of broad S3 access "to be safe", the agent gets exactly this. If it is ever misled (for
+example by instructions hidden in a file it reads), it cannot delete data or touch other buckets.
+
+```bash
+python examples/ai_agent.py            # scripted stand-in, no API key, fake AWS
+python examples/ai_agent.py --claude   # real Claude drives the agent (pip install anthropic)
+```
+`rec.explain()` produces the plain-English summary with ordinary code, not an LLM, so it is
+always exactly what the policy says.
+
+## From your test suite (pytest plugin)
+```bash
+pytest --asp                    # writes asp-policy.json: the permissions your tests needed
+pytest --asp-check role.json    # fails the run if the code needs actions role.json doesn't allow
+```
+Put `--asp-check` in CI and a change that suddenly needs a new AWS permission is caught before
+it fails in production. Only calls made inside test bodies are recorded: put setup (like creating
+fake buckets with moto) in fixtures so it stays out of the policy.
+
+## Check an existing policy
+```python
+result = rec.check("role_policy.json")   # dict, JSON text or a file path
+print(result.summary())
+```
+```
+missing (code would fail): 0
+unused (can be removed): 2
+  - dynamodb:Scan
+  - iam:CreateUser
+too broad (wildcards): 1
+  - s3:*
+```
+`result.ok` is False when the code needs something the policy doesn't allow, which is handy in CI.
+This first version compares actions, not resources.
+
+## Status
+Early (v0.x). Policies name the exact actions and, for the services above, the exact resources.
+Other services keep `"Resource": "*"`. `rec.policy(scope_resources=False)` gives the old all-`*` form.
+
+Roadmap:
+- [x] Terraform output (`rec.terraform()`)
+- [x] exact IAM names where API and IAM names differ (`src/asp/mappings.py`, contributions welcome)
+- [x] restrict `Resource` to the exact S3 buckets, DynamoDB tables (and indexes), SQS queues, SNS topics, Lambda functions used
+- [x] `check` mode: compare an existing policy with what the code really needs (actions)
+- [x] AI-agent example and plain-English `explain()`
+- [x] pytest plugin: `pytest --asp` / `pytest --asp-check role.json`
+
+## Contributing
+Found an AWS call that gets the wrong permission name? Add one row to
+[`mappings.py`](src/asp/mappings.py) plus a test, and open a PR. Issues labelled
+**good first issue** are a good place to start.
+
+## License
+MIT

asp_iam-0.1.0/README.md

@@ -0,0 +1,128 @@
+# asp: Agent Scoped Permissions
+
+[![ci](https://github.com/Kxvya18/asp/actions/workflows/ci.yml/badge.svg)](https://github.com/Kxvya18/asp/actions/workflows/ci.yml)
+[![PyPI](https://img.shields.io/pypi/v/asp-iam)](https://pypi.org/project/asp-iam/)
+[![Python](https://img.shields.io/pypi/pyversions/asp-iam)](https://pypi.org/project/asp-iam/)
+[![License: MIT](https://img.shields.io/badge/license-MIT-blue)](LICENSE)
+
+Record the AWS calls your Python code, or your **AI agent**, actually makes, and get the
+**least-privilege IAM policy** for it.
+
+```python
+from asp import record
+
+with record() as rec:
+    run_my_script()            # or: agent.run("archive last month's reports")
+
+print(rec.policy_json())
+```
+
+```json
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {"Effect": "Allow", "Action": ["s3:GetObject"], "Resource": "arn:aws:s3:::reports/*"},
+    {"Effect": "Allow", "Action": ["s3:PutObject"], "Resource": "arn:aws:s3:::archive/*"}
+  ]
+}
+```
+It only reads from `reports` and only writes to `archive`, because that's all the code did.
+
+## Why
+AI agents and scripts are often given broad AWS permissions because nobody knows what they
+really need. `asp` watches what they actually do and writes the smallest policy that allows it.
+It works offline with [moto](https://github.com/getmoto/moto), so it fits in your tests.
+
+## Install
+```bash
+pip install asp-iam
+```
+
+## Use
+```python
+from asp import record
+
+# as a block
+with record() as rec:
+    ...
+rec.actions()       # ['dynamodb:PutItem', 's3:GetObject']
+rec.policy()        # dict
+rec.save("policy.json")
+rec.terraform()     # the same policy as a Terraform resource
+
+# as a decorator
+@record(save_to="policy.json")
+def nightly_job():
+    ...
+```
+
+## Correct permission names
+Python call names aren't always permission names: `list_objects_v2` needs `s3:ListBucket`,
+`copy_object` needs `s3:GetObject` + `s3:PutObject`, CloudWatch calls need `cloudwatch:*`,
+Bedrock's `Converse` needs `bedrock:InvokeModel`. These exceptions live in one readable table,
+[`mappings.py`](src/asp/mappings.py). Found a missing one? Add a row and a test.
+
+## AI agents: give them only what they use
+[`examples/ai_agent.py`](examples/ai_agent.py) gives an agent three AWS tools (list, read, write
+files) and the task *"summarise the October report and save it to the archive"*. Recorded with asp:
+
+```
+The agent needed only this:
+- read files in bucket 'reports'
+- list files in bucket 'reports'
+- write files in bucket 'archive'
+```
+Instead of broad S3 access "to be safe", the agent gets exactly this. If it is ever misled (for
+example by instructions hidden in a file it reads), it cannot delete data or touch other buckets.
+
+```bash
+python examples/ai_agent.py            # scripted stand-in, no API key, fake AWS
+python examples/ai_agent.py --claude   # real Claude drives the agent (pip install anthropic)
+```
+`rec.explain()` produces the plain-English summary with ordinary code, not an LLM, so it is
+always exactly what the policy says.
+
+## From your test suite (pytest plugin)
+```bash
+pytest --asp                    # writes asp-policy.json: the permissions your tests needed
+pytest --asp-check role.json    # fails the run if the code needs actions role.json doesn't allow
+```
+Put `--asp-check` in CI and a change that suddenly needs a new AWS permission is caught before
+it fails in production. Only calls made inside test bodies are recorded: put setup (like creating
+fake buckets with moto) in fixtures so it stays out of the policy.
+
+## Check an existing policy
+```python
+result = rec.check("role_policy.json")   # dict, JSON text or a file path
+print(result.summary())
+```
+```
+missing (code would fail): 0
+unused (can be removed): 2
+  - dynamodb:Scan
+  - iam:CreateUser
+too broad (wildcards): 1
+  - s3:*
+```
+`result.ok` is False when the code needs something the policy doesn't allow, which is handy in CI.
+This first version compares actions, not resources.
+
+## Status
+Early (v0.x). Policies name the exact actions and, for the services above, the exact resources.
+Other services keep `"Resource": "*"`. `rec.policy(scope_resources=False)` gives the old all-`*` form.
+
+Roadmap:
+- [x] Terraform output (`rec.terraform()`)
+- [x] exact IAM names where API and IAM names differ (`src/asp/mappings.py`, contributions welcome)
+- [x] restrict `Resource` to the exact S3 buckets, DynamoDB tables (and indexes), SQS queues, SNS topics, Lambda functions used
+- [x] `check` mode: compare an existing policy with what the code really needs (actions)
+- [x] AI-agent example and plain-English `explain()`
+- [x] pytest plugin: `pytest --asp` / `pytest --asp-check role.json`
+
+## Contributing
+Found an AWS call that gets the wrong permission name? Add one row to
+[`mappings.py`](src/asp/mappings.py) plus a test, and open a PR. Issues labelled
+**good first issue** are a good place to start.
+
+## License
+MIT

asp_iam-0.1.0/examples/ai_agent.py

@@ -0,0 +1,146 @@
+"""An AI agent with AWS tools, recorded by asp. Its least-privilege policy comes out at the end.
+
+    uv run python examples/ai_agent.py            # scripted stand-in, no API key needed
+    uv run python examples/ai_agent.py --claude   # real Claude drives the agent
+
+--claude needs `pip install anthropic` and Anthropic credentials.
+
+AWS is faked with moto either way, so nothing touches a real account.
+"""
+
+import json
+import os
+import sys
+
+import boto3
+from moto import mock_aws
+
+from asp import record
+
+os.environ.setdefault("AWS_ACCESS_KEY_ID", "testing")
+os.environ.setdefault("AWS_SECRET_ACCESS_KEY", "testing")
+
+TASK = (
+    "Summarise the October report in the 'reports' bucket in one sentence and "
+    "save the summary to the 'archive' bucket as october-summary.txt."
+)
+
+# ---- the agent's tools: plain Python functions that use boto3 ---------------------------
+
+s3 = None  # created inside mock_aws below
+
+
+def list_files(bucket):
+    return [o["Key"] for o in s3.list_objects_v2(Bucket=bucket).get("Contents", [])]
+
+
+def read_file(bucket, key):
+    return s3.get_object(Bucket=bucket, Key=key)["Body"].read().decode()
+
+
+def write_file(bucket, key, text):
+    s3.put_object(Bucket=bucket, Key=key, Body=text.encode())
+    return "saved"
+
+
+TOOLS = {"list_files": list_files, "read_file": read_file, "write_file": write_file}
+
+TOOL_SCHEMAS = [
+    {
+        "name": "list_files",
+        "description": "List the files in an S3 bucket.",
+        "input_schema": {
+            "type": "object",
+            "properties": {"bucket": {"type": "string"}},
+            "required": ["bucket"],
+        },
+    },
+    {
+        "name": "read_file",
+        "description": "Read a text file from an S3 bucket.",
+        "input_schema": {
+            "type": "object",
+            "properties": {"bucket": {"type": "string"}, "key": {"type": "string"}},
+            "required": ["bucket", "key"],
+        },
+    },
+    {
+        "name": "write_file",
+        "description": "Write a text file to an S3 bucket.",
+        "input_schema": {
+            "type": "object",
+            "properties": {
+                "bucket": {"type": "string"},
+                "key": {"type": "string"},
+                "text": {"type": "string"},
+            },
+            "required": ["bucket", "key", "text"],
+        },
+    },
+]
+
+
+# ---- two ways to drive the agent ----------------------------------------------------------
+
+
+def run_scripted():
+    """What a well-behaved agent does for TASK, without calling an LLM."""
+    files = list_files("reports")
+    report = read_file("reports", files[0])
+    lines = report.strip().splitlines()[1:]
+    write_file(
+        "archive",
+        "october-summary.txt",
+        f"October: {len(lines)} sites shipped {sum(int(r.split(',')[1]) for r in lines)} pallets.",
+    )
+
+
+def run_with_claude():
+    """A plain agent loop: ask Claude, run the tools it asks for, send results back."""
+    import anthropic
+
+    client = anthropic.Anthropic()
+    messages = [{"role": "user", "content": TASK}]
+    while True:
+        response = client.beta.messages.create(
+            model="claude-opus-5-5",
+            max_tokens=16000,
+            tools=TOOL_SCHEMAS,
+            messages=messages,
+            betas=["server-side-fallback-2026-07-01"],
+            fallbacks="default",  # if the model declines, the API retries on a fallback model
+        )
+        if response.stop_reason == "refusal":
+            sys.exit("The model declined the task.")
+        if response.stop_reason != "tool_use":
+            return next((b.text for b in response.content if b.type == "text"), "")
+        messages.append({"role": "assistant", "content": response.content})
+        results = []
+        for block in response.content:
+            if block.type == "tool_use":
+                output = TOOLS[block.name](**block.input)
+                results.append(
+                    {"type": "tool_result", "tool_use_id": block.id, "content": json.dumps(output)}
+                )
+        messages.append({"role": "user", "content": results})
+
+
+if __name__ == "__main__":
+    with mock_aws():
+        s3 = boto3.client("s3", region_name="us-east-1")
+        for name in ("reports", "archive"):
+            s3.create_bucket(Bucket=name)
+        s3.put_object(
+            Bucket="reports",
+            Key="october.csv",
+            Body=b"site,pallets\nS01,1200\nS02,2100\nS03,1800\n",
+        )
+
+        with record() as rec:  # <- everything the agent does on AWS is recorded
+            if "--claude" in sys.argv:
+                print("Claude says:", run_with_claude())
+            else:
+                run_scripted()
+
+        print("\nThe agent needed only this:\n" + rec.explain())
+        print("\nLeast-privilege policy for the agent:\n" + rec.policy_json())

asp_iam-0.1.0/examples/quickstart.py

@@ -0,0 +1,29 @@
+"""Run: uv run python examples/quickstart.py   (no AWS account needed: moto fakes AWS)"""
+
+import os
+
+import boto3
+from moto import mock_aws
+
+from asp import record
+
+os.environ.setdefault("AWS_ACCESS_KEY_ID", "testing")
+os.environ.setdefault("AWS_SECRET_ACCESS_KEY", "testing")
+
+
+def archive_report(s3):
+    """A tiny 'job': copy a report into an archive bucket."""
+    body = s3.get_object(Bucket="reports", Key="october.csv")["Body"].read()
+    s3.put_object(Bucket="archive", Key="2026/october.csv", Body=body)
+
+
+with mock_aws():
+    s3 = boto3.client("s3", region_name="us-east-1")
+    for name in ("reports", "archive"):
+        s3.create_bucket(Bucket=name)
+    s3.put_object(Bucket="reports", Key="october.csv", Body=b"site,pallets\nS01,1200\n")
+
+    with record() as rec:
+        archive_report(s3)
+
+    print(rec.policy_json())

asp_iam-0.1.0/examples/terraform_output.py

@@ -0,0 +1,25 @@
+"""Write the recorded policy as Terraform: uv run python examples/terraform_output.py
+Creates examples/out/policy.tf (CI checks it with `terraform validate`)."""
+
+import os
+from pathlib import Path
+
+import boto3
+from moto import mock_aws
+
+from asp import record
+
+os.environ.setdefault("AWS_ACCESS_KEY_ID", "testing")
+os.environ.setdefault("AWS_SECRET_ACCESS_KEY", "testing")
+
+with mock_aws():
+    s3 = boto3.client("s3", region_name="us-east-1")
+    s3.create_bucket(Bucket="reports")
+    with record() as rec:
+        s3.put_object(Bucket="reports", Key="a.csv", Body=b"x")
+        s3.get_object(Bucket="reports", Key="a.csv")
+
+out = Path(__file__).parent / "out"
+out.mkdir(exist_ok=True)
+(out / "policy.tf").write_text(rec.terraform(policy_name="reports-writer"))
+print((out / "policy.tf").read_text())

asp_iam-0.1.0/pyproject.toml

@@ -0,0 +1,51 @@
+[project]
+name = "asp-iam"
+version = "0.1.0"
+description = "Agent Scoped Permissions: record the AWS calls your code (or AI agent) makes and get the least-privilege IAM policy"
+readme = "README.md"
+license = "MIT"
+requires-python = ">=3.10"
+authors = [{ name = "Kxvya18" }]
+keywords = ["aws", "iam", "least-privilege", "security", "boto3", "ai-agents", "devsecops"]
+classifiers = [
+    "Development Status :: 3 - Alpha",
+    "Framework :: Pytest",
+    "License :: OSI Approved :: MIT License",
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3.10",
+    "Programming Language :: Python :: 3.11",
+    "Programming Language :: Python :: 3.12",
+    "Programming Language :: Python :: 3.13",
+    "Topic :: Security",
+    "Topic :: System :: Systems Administration",
+    "Intended Audience :: Developers",
+]
+dependencies = ["boto3>=1.26"]
+
+[project.urls]
+Homepage = "https://github.com/Kxvya18/asp"
+Issues = "https://github.com/Kxvya18/asp/issues"
+Changelog = "https://github.com/Kxvya18/asp/blob/main/CHANGELOG.md"
+
+[dependency-groups]
+dev = ["pytest>=8", "moto[s3,dynamodb,sqs]>=5", "ruff>=0.5"]
+examples = [
+    "anthropic>=1.13.0",
+]
+
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/asp"]
+
+[tool.ruff]
+line-length = 100
+target-version = "py310"
+
+[tool.ruff.lint]
+select = ["E", "F", "I", "B", "UP"]
+
+[project.entry-points.pytest11]
+asp = "asp.pytest_plugin"

asp_iam-0.1.0/src/asp/__init__.py

@@ -0,0 +1,16 @@
+"""asp - Agent Scoped Permissions.
+
+Record the AWS calls your code (or AI agent) makes and get the least-privilege IAM policy.
+
+    from asp import record
+
+    with record() as rec:
+        run_my_script()
+    print(rec.policy_json())
+"""
+
+from asp.check import CheckResult, check
+from asp.recorder import Call, Recorder, record
+
+__all__ = ["Call", "CheckResult", "Recorder", "check", "record"]
+__version__ = "0.1.0"