Agent Permission Kit

I inventoried the tools in src/server.ts and put one fail-closed policy in front of all of them.

Policy

src/tool-policy.ts

import { createGuard } from "agent-permission-kit";

type Ctx = { role: "member" | "admin"; userId: string };

export const guard = createGuard<Record<string, unknown>, Ctx>({
  rules: {
    "db.query": "allow",
    "db.delete": ({ context }) =>
      context?.role === "admin" ? "allow" : { decision: "deny", reason: "Only admins can delete records" },
    "payments.send": ({ input }) =>
      (input as { amount: number }).amount > 100
        ? { decision: "require_approval", reason: "Payments above $100 need a human" }
        : "allow",
  },
  onApprovalRequired: async (req) => {
    const ok = await askOnSlack(`Send $${(req.input as { amount: number }).amount}?`, req.signal);
    return ok ? { approved: true, approvedBy: ok.userId } : { approved: false };
  },
  onAudit: (event) => logger.info(event, `tool ${event.type}: ${event.tool}`),
});

src/server.ts

import { guardMcpServer } from "agent-permission-kit/mcp";

const server = new McpServer({ name: "billing", version: "1.0.0" });
guardMcpServer(server, guard, {
  context: (extra) => ({ role: roleFrom(extra.authInfo), userId: userFrom(extra.authInfo) }),
});
// every registerTool below is now guarded; unknown tools are denied

test/tool-policy.test.ts

import { expectDecisions } from "agent-permission-kit/testing";

await expectDecisions(guard, [
  ["db.query", {}, "allow", member],
  ["db.delete", { id: 1 }, "deny", member],
  ["db.delete", { id: 1 }, "allow", admin],
  ["payments.send", { amount: 40 }, "allow", member],
  ["payments.send", { amount: 250 }, "require_approval", member],
  ["shell.exec", {}, "deny", admin],
]);

Next steps

1. Replace askOnSlack with your approval channel, and authenticate who approves.
2. Add a coverage test: every registered tool must have a rule, so new tools fail CI until someone decides.
3. Make sure info-level logs reach production, so allowed calls are audited too.