Policy lab
What should happen
before this action runs?
Change the conditions and inspect the decision. This is a small, deterministic example of an action guardrail.
Require approval before the side effect
Wait for approval
A production restart needs approval bound to this exact action and target. It has not run.
Runs in your browser. Nothing is sent to an agent or a server. This example is not a security boundary and does not execute a command.
The rules, in order
- Reject unknown actions and environments.
- Stop if the policy cannot be checked.
- Deny requests outside the agent's target access.
- Deny customer data export in this example.
- Hold a production restart until the exact request has approval.
- Allow the remaining declared actions.
The rule order matters. Selecting approval does not grant access to a new target or permit a forbidden action. A production implementation must bind the decision to authenticated identity, exact arguments and current policy at execution time.
Read about tool-call guardrails or build a test set for your own rules.