The vps-agent Preset: Response Policy, Approvals, and Recovery

What 1-SEC checks

GetPresetBundle combines response policies with the preset-specific escalation and approval-gate settings. The vps-agent preset includes aggressive process and file response rules, and selected actions skip approval. It is intended for a narrowly scoped autonomous host rather than a shared production machine.

Read the implementation: GetPresetBundle

Required telemetry and context

This control uses an explicit configuration/API path rather than a standalone detector input event. Verify the caller and configuration before relying on its result.

• enforcement.enabled
• enforcement.preset
• enforcement.dry_run
• module policies
• response target context

Field names above describe relevant context, not a complete API request. Consult the current event contract for envelope and detail requirements. Preserve booleans, numbers, and strings as the receiving handler expects them. Agent-provided text cannot independently verify identity or authorization.

Deployment, prevention, and response

Inspect the full bundle, not just the policy names. Start with dry-run observations, identify the service account and recoverable workspace, and establish out-of-band access. Review approval bypass and escalation behavior before enabling actions on a real host.

Record the source event, affected agent/host, actual target, policy decision, and response result. Review enforcement configuration separately from detection. A recommendation, selected action, dry-run record, and completed action are different outcomes.

Reproduce the source fixtures

From a checkout of the linked 1-SEC source revision, run the selected fixtures with the repository's Go toolchain. These commands run tests; they do not execute a real attack against your systems.

go test ./internal/core -run '^(TestVPSAgentPreset_CriticalModulesHaveBlockingActions|TestVPSAgentPreset_LowPriorityModulesAreRelaxed)$' -count=1

The referenced source fixtures ran in the selected local package suites. Helper tests and synthetic events establish only the assertions shown, not production prevention or framework compatibility.

func TestVPSAgentPreset_CriticalModulesHaveBlockingActions(t *testing.T) {
	policies := GetPresetPolicies("vps-agent")

	// These modules are critical for AI agent VPS defense and must have
	// blocking/enforcement actions, not just log+webhook.
	criticalModules := []string{
		"auth_fortress", "llm_firewall", "ai_containment",
		"runtime_watcher", "supply_chain", "network_guardian",
	}

	blockingActions := map[string]bool{
		"block_ip": true, "kill_process": true, "quarantine_file": true,
		"drop_connection": true, "disable_user": true,
	}

	for _, mod := range criticalModules {
		policy, ok := policies[mod]
		if !ok {
			t.Errorf("vps-agent preset missing critical module %q", mod)
			continue
		}
		hasBlocking := false
		for _, action := range policy.Actions {
			if blockingActions[action.Action] {
				hasBlocking = true
				break
			}
		}
		if !hasBlocking {
			t.Errorf("vps-agent preset critical module %q has no blocking actions", mod)
		}
	}
}

func TestVPSAgentPreset_LowPriorityModulesAreRelaxed(t *testing.T) {
	policies := GetPresetPolicies("vps-agent")

	// These modules are less relevant for a single-VPS AI agent and should
	// have higher severity thresholds (HIGH or above).
	relaxedModules := []string{"iot_shield", "deepfake_shield", "quantum_crypto"}

	for _, mod := range relaxedModules {
		policy, ok := policies[mod]
		if !ok {
			t.Errorf("vps-agent preset missing module %q", mod)
			continue
		}
		sev := ParseSeverity(policy.MinSeverity)
		if sev < ParseSeverity("HIGH") {
			t.Errorf("vps-agent preset module %q should have min_severity >= HIGH, got %s", mod, policy.MinSeverity)
		}
	}
}

Tuning, evaluation, and coverage limits

A preset is not a native integration with every agent framework. Killing or quarantining requires the actual process/file target, suitable permissions, and an executor that supports the action. Selecting a preset does not validate that target or guarantee safe recovery.

Evaluate this behavior with representative authorized activity and a controlled known-positive case. Investigate the exact rule, inputs, and state before suppressing an alert. Do not assume a hard-coded heuristic is a configurable setting. Measure your own deployment; the source fixtures do not establish a benchmark, detection rate, compliance certification, or incident-prevention claim.