The security firewall for agents

# Customer-support replies sent from the agent are scanned by an LLM
# judge before they go out: catches offensive content, missing
# salutations, and markdown that shouldn't ship.

rule "support-reply-on-behalf" {
  endpoint = http.deno-deploy
  condition = <<-CEL
    http.method == 'POST'
    && http.path == '/api/admin.supportTickets.replyOnBehalf'
  CEL
  approve = [llm_approver.reply-content-judge]
}

# Block Postgres functions that could read the filesystem or open
# outbound connections from inside the database — pg_read_file,
# lo_get, and the whole dblink family.

rule "pg-banned-functions" {
  endpoint = postgres.pg-staging
  priority = 100
  condition = <<-CEL
    sets.intersects(sql.functions, [
      'pg_read_file', 'pg_read_binary_file', 'lo_get',
    ])
    || sql.functions.exists(f, f.startsWith('dblink_'))
  CEL
  verdict = "deny"
  reason  = "filesystem-reaching function"
}

# kubectl exec is gated by an LLM judge that reads the command argv:
# allows ls / ps / df, denies env dumps, sensitive file reads, and
# anything touching pod tokens or container sockets.

rule "k8s-exec-content-check" {
  endpoints = [kubernetes.k8s-dev, kubernetes.k8s-prod]
  priority  = 500
  condition = "k8s.resource == 'pods/exec'"
  approve   = [llm_approver.k8s-exec-content-judge]
}