tool_policy

Fail-closed control over which tools the agent can call.

What it mitigates

• Undocumented tool invocation
• Tool surface expansion without review
• Privilege drift across environments

Recommended defaults

Minimal config

moduleConfig:
  tool_policy:
    default: deny
    # rules:
    #   Add explicit allow/deny entries per tool used by your orchestrator.
    #   You can also attach egress bindings per tool.

Egress binding example:

moduleConfig:
  tool_policy:
    default: deny
    rules:
      - tool: "SlackSend"
        action: allow
        egress:
          allowedDomains:
            - "api.slack.com"

Practical rollout

1. Start with default: deny.
2. Run real workflows and collect denied tool names from audit.
3. Add explicit allow rules only for required tools.
4. Add per-tool egress bindings for networked tools.
5. Re-run npx agentradius pentest after every policy change.

Related modules

• command_guard
• fs_guard
• audit