The security firewall for agents

# User-visible messages sent from the agent are scanned by an LLM
# judge before they go out: catches unsafe content, missing context,
# and markdown that should not ship.

rule "message-send-content-check" {
  endpoint = https.messaging-api
  condition = <<-CEL
    http.method == 'POST'
    && http.path == '/v1/messages/send'
  CEL
  approve = [llm_approver.message-content-judge]
}

# Block Postgres functions that could read the filesystem or open
# outbound connections from inside the database — pg_read_file,
# lo_get, and the whole dblink family.

rule "pg-banned-functions" {
  endpoint = postgres.pg-staging
  priority = 100
  condition = <<-CEL
    sets.intersects(sql.functions, [
      'pg_read_file', 'pg_read_binary_file', 'lo_get',
    ])
    || sql.functions.exists(f, f.startsWith('dblink_'))
  CEL
  verdict = "deny"
  reason  = "filesystem-reaching function"
}

# kubectl exec is gated by an LLM judge that reads the command argv:
# allows ls / ps / df, denies env dumps, sensitive file reads, and
# anything touching pod tokens or container sockets.

rule "k8s-exec-content-check" {
  endpoints = [kubernetes.k8s-dev, kubernetes.k8s-prod]
  priority  = 500
  condition = "k8s.resource == 'pods/exec'"
  approve   = [llm_approver.k8s-exec-content-judge]
}