An RBAC-change event starts an investigation. The model proposes the next question. Deterministic code decides what it is allowed to ask.
Source: experimental 0.2.1. The only published release is v0.2.0; publishing v0.2.1 is a separate maintainer action.
事件觸發調查。模型提出問題，程式碼守住權限、預算與證據邊界。
01 / THE AUTHORITY BOUNDARY
Policy is never a prompt suggestion. Every model request passes a fixed registry, exact resource scope and a pre-call budget.
Validate. Claim once.
Load trusted limits.
Propose a typed action.
Reserve before calling.
Allowlisted reads only.
Hash and persist evidence.
Validate every reference.
Persist. Terminate.
No shell. No arbitrary HTTP or SQL. No kubectl passthrough. No remediation. Evidence text cannot grant new authority.
02 / EXECUTABLE ACCEPTANCE
A replay passes when the expected boundary holds. That does not mean a real environment is secure.
| Scenario | Boundary exercised | Expected investigation |
|---|---|---|
| S01 | Privilege increase without approval | Confirmed suspicious |
| S02 | Approval matches actor, resource and change | Likely benign |
| S03 | Required evidence is unavailable | Insufficient evidence |
| S04 | Injection text + simulated hostile action | Investigation failed safely |
| S05 | Duplicate delivery | Existing result, no extra calls |
| S06 | Hard budget exhausted | Inconclusive |
| S07 | Unregistered capability requested | Investigation failed safely |
| S08 | Finding cites nonexistent evidence | Investigation failed safely |
03 / START LOCALLY
Python 3.11+. Install dependencies once, then run every replay offline. Inspect the persisted evidence and audit alongside the result. Missing evidence never silently becomes benign.
.[dev] includes the offline HTTP mocks. Paid model calls require an explicit provider invocation and still use fixture evidence; see the opt-in model setup.
git clone https://github.com/trionnemesis/AgenticDef.git
cd AgenticDef
python -m venv .venv
source .venv/bin/activate
pip install -e '.[dev]'
python -m pytest -q
replay scenarios --allA fresh temporary output directory is created for each run. Output includes statuses, evidence references, budgets and terminal state. Reusing an explicit output directory returns saved terminal results.
04 / HONEST STATUS
Follow-ups #4–#8 and tracker #9 are closed. Both evaluation decisions are made: an offline evaluation layer outside the runtime grades semantic correctness against a deterministic RBAC oracle (#20, #21), and an opt-in, capped live smoke protocol is committed but not yet run (#22). The v0.3 decision gate is still open. Read the roadmap ↗
Offline regressions and deterministic S01–S08 replay check contracts, scope, grounding, budgets, cancellation and duplicates. Scripted HTTP mocks also run S01/S02 through the shared core and evaluator; an inverted verdict fails the status/risk checks. An offline evaluation layer compares baselines against a deterministic RBAC oracle on seeded cases.
Inspect acceptance evidence ↗The Anthropic adapter is tested with mock transport. A metered smoke protocol (claude-sonnet-5-5, 20 synthetic cases, at most US$10) is committed but has not been run. Actual API calls, model behavior on hostile evidence and live detection accuracy remain unverified.
No GKE dispatch, live cluster evidence, production SOC, multi-agent orchestration or infrastructure mutation is implemented.
Explore the architecture ↗