Sekuire Policy System

Define fine-grained governance policies for AI agents using AWS IAM-inspired syntax

Quick Start

What are Sekuire Policies? Policies define what actions AI agents can perform, on which resources, and under what conditions. They use a familiar JSON structure inspired by AWS IAM policies.

Workspace-Scoped

Policies are assigned to workspaces, allowing different teams to have different governance rules within the same organization.

Real-Time Enforcement

Policies are evaluated in real-time as agents attempt actions. Denied actions are blocked immediately and logged for audit.

Policy Structure

A Sekuire policy consists of the following top-level fields:

{
  "Version": "2024-12-02",
  "Description": "Human-readable description of this policy",
  "Statement": [
    {
      "Sid": "StatementID",
      "Effect": "Allow | Deny",
      "Action": "action | [actions]",
      "Resource": "resource | [resources]",
      "Condition": {}
    }
  ],
  "ResourceLimits": {},
  "RequireApproval": {},
  "AuditLog": {}
}

Version (required)

Format: YYYY-MM-DD
Current version: 2024-12-02

Statement (required)

Array of policy statements defining what is allowed or denied. Each statement contains:

  • Effect: Allow or Deny
  • Action: Actions to allow/deny (string or array)
  • Resource: Resources the actions apply to (string or array)
  • Condition: Optional conditions (object)
  • Sid: Optional statement ID for documentation

ResourceLimits (optional)

Set limits on agent resource usage: execution time, tokens, cost, memory, concurrent requests, API calls, and storage.

RequireApproval (optional)

Specify actions that require human approval before execution. Includes approver role, timeout, and notification channels.

AuditLog (optional)

Configure audit logging: retention period, what to include, and PII redaction settings.

Actions

Actions follow the format: resource:action[:subaction]

File Operations

file:Read
file:Write
file:Delete
file:List
file:*

Database Operations

db:Select
db:Insert
db:Update
db:Delete
db:Schema
db:*

API Operations

api:Get
api:Post
api:Put
api:Delete
api:*

Tool Operations

tool:bash:execute
tool:git:commit
tool:docker:run
tool:*

Agent Operations

agent:Call
agent:Delegate
agent:Subscribe
agent:*

Data Operations

data:ReadPII
data:ReadFinancial
data:ReadHealth
data:*

Wildcards: Use * to match all actions in a category (e.g., file:*) or all actions (*)

Resources

Resources use URI-like format: protocol://path/*

file://workspace/*

All files in the workspace directory

file://workspace/tmp/*

Only files in the temporary directory

https://api.example.com/*

All endpoints on api.example.com

db://production/*

All tables in the production database

db://analytics/users

Only the users table in analytics database

*

All resources (use with caution)

Conditions

Conditions allow you to add contextual restrictions to policy statements.

StringEquals

Match exact string values

"Condition": {
  "StringEquals": {
    "context.environment": "production"
  }
}

StringLike

Match strings with wildcards

"Condition": {
  "StringLike": {
    "resource.path": "/api/v*/users/*"
  }
}

IpAddress

Match source IP address or CIDR range

"Condition": {
  "IpAddress": {
    "source.ip": ["10.0.0.0/8", "172.16.0.0/12"]
  }
}

NumericLessThan

Numeric comparison

"Condition": {
  "NumericLessThan": {
    "context.cost": 100.00
  }
}

Bool

Boolean condition check

"Condition": {
  "Bool": {
    "encryption.enabled": true
  }
}

DateLessThan

Date/time comparison

"Condition": {
  "DateLessThan": {
    "time.current": "2024-12-31T23:59:59Z"
  }
}

Policy Templates

Start with one of our pre-built templates and customize as needed.

Development Policy

Permissive policy for development environments with read/write access and moderate limits

{
  "Version": "2024-12-02",
  "Description": "Permissive policy for development environments",
  "Statement": [
    {
      "Sid": "AllowAllRead",
      "Effect": "Allow",
      "Action": [
        "file:Read",
        "file:List",
        "api:Get",
        "db:Select"
      ],
      "Resource": "*"
    },
    {
      "Sid": "AllowSafeWrites",
      "Effect": "Allow",
      "Action": [
        "file:Write",
        "api:Post"
      ],
      "Resource": [
        "file://workspace/tmp/*",
        "https://api.staging.example.com/*"
      ]
    }
  ],
  "ResourceLimits": {
    "MaxExecutionTime": "600s",
    "MaxTokens": 50000,
    "MaxCostPerHour": "$10.00",
    "MaxMemory": "8GB"
  },
  "AuditLog": {
    "Required": true,
    "RetentionDays": 30,
    "Include": [
      "all_actions",
      "outcomes"
    ]
  }
}

Production Policy

Restricted policy for production with read-only access, approval requirements, and strict limits

{
  "Version": "2024-12-02",
  "Description": "Restricted policy for production environments",
  "Statement": [
    {
      "Sid": "AllowReadOnly",
      "Effect": "Allow",
      "Action": [
        "file:Read",
        "api:Get",
        "db:Select"
      ],
      "Resource": "*",
      "Condition": {
        "IpAddress": {
          "source.ip": [
            "10.0.0.0/8",
            "172.16.0.0/12"
          ]
        }
      }
    },
    {
      "Sid": "DenyDestructive",
      "Effect": "Deny",
      "Action": [
        "file:Delete",
        "db:Delete",
        "db:Schema"
      ],
      "Resource": "*"
    }
  ],
  "ResourceLimits": {
    "MaxExecutionTime": "300s",
    "MaxTokens": 10000,
    "MaxCostPerHour": "$5.00",
    "MaxMemory": "4GB",
    "MaxConcurrentRequests": 5
  },
  "RequireApproval": {
    "Actions": [
      "db:Update",
      "db:Insert",
      "file:Write",
      "api:Post",
      "api:Put"
    ],
    "ApproverRole": "admin",
    "TimeoutSeconds": 1800
  },
  "AuditLog": {
    "Required": true,
    "RetentionDays": 90,
    "Include": [
      "all_actions",
      "resources",
      "outcomes",
      "timestamps",
      "context"
    ],
    "RedactPII": true
  }
}

HIPAA Compliant Policy

Healthcare-focused policy with encryption requirements, 7-year audit retention, and strict approval workflows

{
  "Version": "2024-12-02",
  "Description": "HIPAA-compliant policy for healthcare data",
  "Statement": [
    {
      "Sid": "AllowEncryptedHealthData",
      "Effect": "Allow",
      "Action": [
        "data:ReadHealth"
      ],
      "Resource": "db://healthcare/*",
      "Condition": {
        "Bool": {
          "encryption.enabled": true
        },
        "StringEquals": {
          "data.classification": "PHI"
        }
      }
    },
    {
      "Sid": "DenyUnencryptedAccess",
      "Effect": "Deny",
      "Action": "*",
      "Resource": "*",
      "Condition": {
        "Bool": {
          "encryption.enabled": false
        }
      }
    }
  ],
  "ResourceLimits": {
    "MaxExecutionTime": "120s",
    "MaxMemory": "2GB"
  },
  "RequireApproval": {
    "Actions": [
      "data:ReadHealth",
      "data:WriteHealth"
    ],
    "ApproverRole": "admin",
    "TimeoutSeconds": 3600
  },
  "AuditLog": {
    "Required": true,
    "RetentionDays": 2555,
    "Include": [
      "all_actions",
      "resources",
      "outcomes",
      "timestamps",
      "context"
    ],
    "RedactPII": false
  }
}

Interactive Policy Validator

Test your policy syntax in real-time. Paste your policy JSON below to validate it.

Policy Validator

Edit the policy JSON below to validate in real-time

Not Validated

Best Practices

✅ Use Principle of Least Privilege

Grant only the minimum permissions needed for agents to perform their tasks. Start restrictive and expand as needed.

✅ Use Explicit Deny for Critical Resources

Explicitly deny access to sensitive operations like deletions, schema changes, or access to production databases.

✅ Require Approval for High-Risk Actions

Use the RequireApproval field for actions that modify critical data or systems.

✅ Set Resource Limits

Always set ResourceLimits to prevent runaway costs and resource exhaustion.

❌ Don't Use Wildcard Allow-All in Production

Avoid "Action": "*", "Resource": "*", "Effect": "Allow" in production environments. This grants unlimited access.

❌ Don't Disable Audit Logs

Always keep audit logs enabled for compliance and security incident investigation.