Apache-2.0 · spec-first · v0.1

AgentLaw

A deterministic security contract for AI agents.

Every action an agent takes is checked against rules its operator signed — rules no prompt can rewrite.

A model can be persuaded. A signed policy cannot.

Trust is not a security strategy.

AI agents no longer just converse — they act. They move files, send payments, ship code, holding real credentials. Until now, the only barrier between an agent and an irreversible action was a set of instructions written into its own prompt. And prompt injection is, precisely, the art of defeating those instructions.

AgentLaw starts from a different premise: critical decisions are not requested from the model — they are verified outside of it. Every action passes through an external, deterministic, signed evaluator that cannot be persuaded, negotiated with, or rewritten.

The evaluator is not another AI.

It is a deterministic engine: compiled rules and typed conditions that produce the same verdict for the same input, every time. It does not opine, interpret, tire, or get talked into anything. That is where the guarantee lives: where a model can be deceived, a compiled rule cannot.

How it works

Declare
Write your rules once, in a readable manifest: what is allowed, what requires human approval, what never happens.
Sign
The manifest is sealed with Ed25519 cryptography. The private key never lives where the agent runs: loosening a rule requires the key — not a convincing argument.
Enforce
Every tool call passes through the policy engine — with no model in the loop — and receives a verdict: allow, require approval, or deny. Anything not covered is denied by default, and every decision lands in a hash-chained audit log that cannot be altered without leaving a trace.

Try the engine

Pick a policy, ask an agent to do something, and read the verdict: allowed, held for a human, or refused — together with the exact rule that decided.

The engine runs in this browser. Same parser, same compiled rules, same evaluate() as an enforcement point. No request leaves this page.

An agent that reads case files, drafts and sends mail. Reading is free; anything that leaves the firm or cannot be undone stops for a person.

The policy in force

Parsed and compiled here. The rule that decides is highlighted.

apiVersion: agentlaw/v1alpha1kind: PolicyManifestmetadata:  name: lawfirm-assistant  version: 0.1.0defaults:  effect: denyrules:  - id: casefile-read    match: { server: lawfirm, tool: ["case_search", "doc_summarize", "deadline_list"] }    effect: allow  - id: deadline-write    match: { server: lawfirm, tool: deadline_create }    effect: allow  - id: internal-mail    match: { server: lawfirm, tool: email_send }    when:      - { arg: to, op: endsWith, value: "@estudio.legal" }    effect: allow    else: approve    reason: "mail leaving the firm is read by a person before it is sent"  - id: client-documents    match: { server: lawfirm, tool: doc_share }    when:      - { arg: recipient_is_client, op: eq, value: true }    effect: allow    else: approve    reason: "client material only goes to the client unless someone approves it"  - id: court-filing    match: { server: lawfirm, tool: filing_submit }    effect: approve    reason: "a filing cannot be taken back: a person signs it off"  - id: never-destroy    match: { server: lawfirm, tool: ["case_delete", "doc_purge"] }    effect: forbid    reason: "case files are never destroyed by an agent"limits:  - id: mail-burst    match: { server: lawfirm, tool: email_send }    max: 2    per: 1m    onExceeded: deny

What the agent attempts

Each button is one tool call. Repeat one to meet a rate limit.

Audit log

Empty. Every decision — including the refusals — is appended here, hash-chained to the one before it.

There is no built-in list of forbidden actions — every deployment declares its own.

AgentLaw provides the mechanism — the deterministic verdict, the human approval, the audit trail. The policy itself is declared by each deployment. Three real examples, from the repository's example policies:

A coding agent on a workstation

Reads and edits the project freely; pushes and deletions outside the sandbox require human approval; destructive commands, never.

examples/policies/dev-workstation.yaml

A payments and billing agent

Payments below a threshold go through on their own; above it, a human approves; refunds always pass through a person.

examples/policies/payments-capped.yaml

A research or support agent

Read-only mode: it can look at everything, it can change nothing.

examples/policies/readonly.yaml

Honest security: what it stops, and what it does not.

No serious tool promises total protection. AgentLaw defines its scope with precision — and publishes it.

It stops

Tool calls induced by prompt injection
A confused or overly diligent agent
Credentials with more reach than necessary
Silent drifts in behavior — through the audit trail
Unauthorized loosening of the policy — through the signature

It does not stop

Hostile content returned by permitted tools — the policy stops that text from acting, not from being read
An attacker who holds the private signing key
An attacker with administrator privileges on the host
Side channels inside a permitted tool

AgentLaw complements — it does not replace — the MCP authorization specification and the OWASP LLM Top 10 mitigations.

The PreToolUse hook and the governance console are integration patterns: the core is embeddable wherever an agent acts.

Three ways to deploy it — the same signed policy

Local

One line in your MCP configuration wraps any MCP server, with no changes to clients or servers.

Organization

A gateway deployed once, in front of your remote MCP servers, covers the whole team.

Embedded

The core engine has no MCP dependency — embed it directly into your agent platform.

{
  "mcpServers": {
    "safe-fs": {
      "command": "npx",
      "args": ["-y", "@agentlaw/gateway",
               "--policy", "policy.yaml", "--trust", "policy.pub",
               "--", "npx", "-y",
               "@modelcontextprotocol/server-filesystem", "C:/sandbox"]
    }
  }
}

Quickstart

One command scaffolds a signed, ready-to-run policy — template, thresholds, keypair:

The CLI, at a glance

agentlaw wizard .	Guided setup: picks a template, asks your thresholds, writes a signed policy.yaml plus its keypair.
agentlaw sign	Signs a policy manifest with your Ed25519 private key.
agentlaw verify	Verifies a manifest's signature against a trusted public key.
agentlaw explain	Dry-run: shows the verdict a given tool call would receive, without executing anything.
agentlaw audit verify	Checks the integrity of the hash-chained audit log.

Free, open, and spec-first.

The security of AI agents is a shared responsibility of everyone who builds software. AgentLaw is open source under the Apache-2.0 license and designed spec-first: its specifications (RFC-0001, RFC-0002) are published and open for discussion before the code.

The security engine — policies, signing, enforcement, and audit — is free and self-hostable, and always will be.

Critical readings are welcome.

AgentLaw is at version 0.1 and its RFCs are in Draft. This page will mature with the product — feedback on the spec is as valuable as code.