Policy & approvals

Set the boundaries.

Policy as code

Rules you can read,
review and diff.

Agents, tools and rules live in a repo and go through review like any other change. You write YAML. Fort validates it and compiles it into the policies Warden enforces, using Cedar for tool-call decisions.

kind: Agent
name: sre-agent
image: ghcr.io/acme/sre-agent@sha256:<digest>
providers: [anthropic] # credentials stay outside
egress: []             # no other network access
tool_access:
  - server: ops
    rulesets: [ops-read]
    rules:
      - id: remediation
        tools: [restart_deployment, rollback_deployment]
        when:
          - { arg: $.namespace, in: [checkout, payments] }
        outcome: ask
        reason: change_requires_approval
        ask:
          expiry: 15m
          summary: Restart or roll back a deployment

This excerpt illustrates the rule shape, not a complete deployable bundle. Replace the image digest and declare the referenced provider, tool server and ruleset in the project.

What this rule means

The agent can use the ops tool server under its referenced read rules. A restart or rollback in checkout or payments asks for approval. Any matching deny rule still wins, and a call with no matching rule is denied.

Where Cedar fits

YAML is Fort’s authoring format. The compiler validates your configuration, creates the policy representation, and generates a Cedar schema and policies. You do not need to maintain a second set of handwritten Cedar policies.

Fort’s policy layer combines the matching outcomes with the precedence above. ask is a Fort decision that starts an approval flow; it is not a standalone Cedar keyword.

Explain the policy you enforce

fort explain agent describes what an agent can and cannot do, generated from the effective policy. It helps reviewers see the boundaries before an agent acts.

Human oversight

Risky actions wait for a person.

An ask decision does not execute the tool call. It creates a pending approval for a named person. The approver reviews the action and completes a fresh sign-in before granting it.

1. Warden holds the request.The agent’s action has not happened.
2. A person reviews the exact action.They can approve or deny it. An expired approval provides no permission.
3. A grant permits the approved retry.A one-time grant applies to that exact call. Warden checks the retry against the active policy.
4. The decision leaves evidence.The approval and subsequent action are recorded.

A human approval does not override a policy deny or the stop switch.