Class: Phronomy::Agent::Context::Capability::ScopePolicy

Inherits:
Object
  • Object
show all
Defined in:
lib/phronomy/agent/context/capability/scope_policy.rb

Overview

Evaluates whether a tool with a given scope may execute.

A ScopePolicy is a callable that receives (tool_class, scope, agent) and returns one of:

+:allow+   — proceed immediately without an approval gate.
+:reject+  — block execution; the tool returns a denial message.
+:approve+ — delegate to the agent's approval handler (if registered);
           when no handler is registered the call is rejected.

The Default instance is used automatically when no custom policy is configured on an agent.

Examples:

Custom policy that allows everything

agent.scope_policy = ->(_tool_class, _scope, _agent) { :allow }

Strict policy that rejects all write scopes

agent.scope_policy = ->(_tc, scope, _agent) {
  scope == :write ? :reject : :allow
}

Constant Summary collapse

APPROVAL_REQUIRED_SCOPES =

Scopes that must go through an approval gate before execution.

%i[write admin external_network filesystem process external_process].freeze
ALWAYS_ALLOWED_SCOPES =

Scopes that are always permitted without approval.

%i[read_only].freeze
DEFAULT =

Shared singleton used when no custom policy is configured.

new.freeze

Instance Method Summary collapse

Instance Method Details

#call(_tool_class, scope, _agent) ⇒ :allow, ...

This method is part of a private API. You should avoid using this method if possible, as it may be removed or be changed in the future.

Returns :allow for always-allowed scopes, :approve for high-risk scopes, and :allow for anything else (including nil).

Parameters:

  • _tool_class (Class)
  • scope (Symbol, nil)
  • _agent (Object)

Returns:

  • (:allow, :approve, :reject) 


41
42
43
44
45
46
 
# File 'lib/phronomy/agent/context/capability/scope_policy.rb', line 41

def call(_tool_class, scope, _agent)
  return :allow if scope.nil? || ALWAYS_ALLOWED_SCOPES.include?(scope)
  return :approve if APPROVAL_REQUIRED_SCOPES.include?(scope)

  :allow
end