AI Agent Tool Policy: Blocked Tools and Sensitive Targets

What 1-SEC checks

The built-in policy names blocked tools such as shell_exec, raw_sql, file_delete, and credential_access. It also checks selected destructive action patterns and sensitive target strings including .env, .ssh paths, and private-key names. The action tracker separately flags a recent concentration of sensitive-looking targets.

Read the implementation: NewPolicyEngine

Required telemetry and context

Relevant input events: agent_action, tool_call, function_call. Use a trusted producer at the real application boundary.

• agent_id
• action
• tool
• target

Field names above describe relevant context, not a complete API request. Consult the current event contract for envelope and detail requirements. Preserve booleans, numbers, and strings as the receiving handler expects them. Agent-provided text cannot independently verify identity or authorization.

Deployment, prevention, and response

Preserve exact tool/action/target values from a trusted executor. Review legitimate administration and backup tasks as benign controls. Enforce OS permissions, scoped file APIs, and tool authorization in the executor. Do not infer that the absence of an alert authorizes an operation. Report the resolved operation target from the trusted filesystem tool. Compare a synthetic sensitive path with an authorized ordinary workspace path; do not treat a nonmatching name as a grant to read the file.

Record the source event, affected agent/host, actual target, policy decision, and response result. Review enforcement configuration separately from detection. A recommendation, selected action, dry-run record, and completed action are different outcomes.

Reproduce the source fixtures

From a checkout of the linked 1-SEC source revision, run the selected fixtures with the repository's Go toolchain. These commands run tests; they do not execute a real attack against your systems.

go test ./internal/modules/aicontainment -run '^(TestPolicyEngine_BlockedTools|TestPolicyEngine_SensitiveTargets|TestPolicyEngine_AllowedActions)$' -count=1

The referenced source fixtures ran in the selected local package suites. Helper tests and synthetic events establish only the assertions shown, not production prevention or framework compatibility.

func TestPolicyEngine_BlockedTools(t *testing.T) {
	pe := NewPolicyEngine()
	blocked := []string{
		"shell_exec", "system_command", "raw_sql", "file_delete",
		"network_scan", "credential_access", "registry_edit",
		"firewall_modify", "user_create",
	}
	for _, tool := range blocked {
		v := pe.Check("agent-1", "do-something", tool, "/tmp/safe")
		if v == nil {
			t.Errorf("Check() should block tool %q", tool)
			continue
		}
		if v.Severity != core.SeverityCritical {
			t.Errorf("blocked tool %q severity = %v, want Critical", tool, v.Severity)
		}
	}
}

func TestPolicyEngine_SensitiveTargets(t *testing.T) {
	pe := NewPolicyEngine()
	targets := []string{
		"/etc/shadow",
		"/home/user/.ssh/id_rsa",
		"/home/user/.aws/credentials",
		"/app/.env",
		"/deploy/secrets.yml",
		"/config/password_store",
		"/keys/private_key.pem",
	}
	for _, target := range targets {
		v := pe.Check("agent-1", "read", "safe_tool", target)
		if v == nil {
			t.Errorf("Check() should flag sensitive target %q", target)
			continue
		}
		if v.Severity != core.SeverityHigh {
			t.Errorf("sensitive target %q severity = %v, want High", target, v.Severity)
		}
	}
}

func TestPolicyEngine_AllowedActions(t *testing.T) {
	pe := NewPolicyEngine()
	cases := []struct {
		action string
		tool   string
		target string
	}{
		{"read file", "file_read", "/tmp/data.txt"},
		{"list directory", "dir_list", "/home/user/docs"},
		{"search logs", "log_search", "/var/log/app.log"},
		{"create report", "report_gen", "/reports/daily.pdf"},
	}
	for _, tc := range cases {
		v := pe.Check("agent-1", tc.action, tc.tool, tc.target)
		if v != nil {
			t.Errorf("Check() should allow action=%q tool=%q target=%q, got violation: %s",
				tc.action, tc.tool, tc.target, v.Reason)
		}
	}
}

// ─── ShadowAIDetector ─────────────────────────────────────────────────────────

Tuning, evaluation, and coverage limits

The policy is a local built-in blocklist and string matcher; it is not a configurable per-role capability sandbox or a universal filesystem permission model. A renamed tool or an unrecognized sensitive path can miss these checks. Reading a process environment without a matching reported target is not automatically observed. For MCP filesystem tools, reported .env or .ssh targets can match these generic checks. The module does not enumerate a server's roots or enforce MCP filesystem roots, symlink containment, or real filesystem access permissions.

Evaluate this behavior with representative authorized activity and a controlled known-positive case. Investigate the exact rule, inputs, and state before suppressing an alert. Do not assume a hard-coded heuristic is a configurable setting. Measure your own deployment; the source fixtures do not establish a benchmark, detection rate, compliance certification, or incident-prevention claim.