feat(policy): enforce a run's policy bundle per-run (allowlist + approval) - #120
Merged
Conversation
…oval) A run created under a bundle (policyRef) is now governed by that bundle, not just its budget — closing the seam the policy-bundle work left open. - Persist policyRef on the run (migration 00006 adds runs.policy_ref; threaded through RunRecord, the runs manager, View/record, and reload — so it survives a restart and the MCP gateway sees it even for a reused run-id). - MCP gateway: the run's bundle allowlist governs its tools/call (a tool outside it is blocked even if the global allowlist would allow it; empty bundle allowlist falls back to global). The bundle's approval rules apply on top of the global fail-safe gating — a bundle can ADD a requirement (e.g. naming a normally read-only tool) but never silently drop the fail-closed gating of side effects. - approval.Gate.RequestUnder(ctx, req, policy) evaluates a supplied policy instead of the gate's default; Request delegates to it. Tests: per-run allowlist (a bundle restricts a run while the global allowlist is allow-all; a no-bundle run still uses global), a bundle rule gating an otherwise read-only tool, and policyRef persist+reload across a restart. docs/POLICY.md gains a "Per-run enforcement" section. Also collapses a duplicated [0.6.0] CHANGELOG header left by an earlier merge and moves the post-release Ollama entry to [Unreleased] where it belongs.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes the seam the policy-bundle work (#28) left open: a run created under a bundle (
policyRef) is now governed by that bundle — not just its budget.What's enforced per-run
toolAllowlistfor itstools/calls: a tool outside it is blocked, even if the global allowlist would allow it. An empty bundle allowlist falls back to the global one.approvalPolicyapplies to that run on top of the global fail-safe gating. A bundle can add a requirement (e.g. name a normally read-only tool) but never silently drop the fail-closed gating of side-effecting tools.policyRefis persisted (migration00006→runs.policy_ref), so enforcement survives a daemon restart and applies even when the MCP gateway resolves a run by its run-id header.How
policyRefthreaded throughRunRecord→ runs manager (Create/View/record/reload) →POST /v1/runs.approval.Gate.RequestUnder(ctx, req, policy)evaluates a supplied policy instead of the gate default;Requestdelegates to it.Tests
RequestUnderwith the bundle policy).policyRefpersists and is restored across a restart (Create→ store →GetOrCreate).go vetclean; full suite green.docs/POLICY.mdgains a Per-run enforcement section.