Current limits

Instrumentation and storage

Policy enforcement depends on faithful observations and checks before side effects. Uninstrumented dispatch paths can bypass the reference monitor; absent graph evidence does not prove an event never happened. Start with the instrumentation contract.

Graph content is sensitive and stored in clear text. Python and TypeScript telemetry copies remove recognized transport credentials from supported content fields by default; arbitrary secrets and direct graph ingestion are not covered. Optional oracle-prompt scrubbing does not redact the graph. Operators must control access, retention, request capacity, and storage capacity; per-tenant rate and durable storage quotas are not implemented.

Trust boundaries

Custom C++ functors run native code and are admin-only unless an operator opts in. In-process evaluator plugins are trusted native code with the engine process’s privileges. Linux sandbox support depends on the host; macOS does not provide the same bubblewrap boundary.

Guard shell gates interpret command text and assume an aligned agent. They do not prove arbitrary shell programs safe or prevent a user controlling the same operating-system account from bypassing hooks. The daemon authenticates its managed local engine using launch-generated mutual TLS. This protects that connection; it does not authenticate HTTP responses to hooks, prove human approval, or stop a same-account process reading local credentials. Stronger isolation needs a separate service identity, protected hook transport, and deployment controls.

A secret read can already disclose its contents to the agent’s model provider: the framework normally sends the tool result in its next model request. The toxic_flow and secret-scan gates check later actions such as outbound commands or pushes; they do not block ordinary secret reads or undo that earlier model request. There is no general secret_read rule group. Keep secrets outside the agent’s readable workspace, or enforce a read boundary before returning tool results. Telemetry credential scrubbing and oracle-prompt redaction do not redact the agent’s original tool result or its own model requests.

The guard bounds inbound bytes, nesting, receive time, concurrent handlers, and live sessions. Authenticated scan status reports observed scanner activity, not enforcement coverage. sasy-watch probe tests four synthetic advisory decisions against an isolated installed engine; it does not prove that a normal agent hook is connected.

Policy analysis and diagnostics

Runtime desugaring still uses sugar.py. The Rust parser accepts builtins used by the shipped guard policy, but full static analysis of builtin-bearing policies reports an explicit unsupported result. Replacing runtime desugaring requires separate equivalence and performance qualification.

Allow-route attribution keeps trusted fixed-request conditions while leaving custom predicates, including approvals, changeable. A route can be blocked, possible, or unknown: blocked means the retained fixed conditions have no shared witness; possible does not establish reachability or a successful repair. Suggestions are author hints. Unsupported syntax or exhausted analysis limits causes a conservative fallback. Generated diagnostics preserve decision rules and do not rerun external functors or freeze gated ancestry. SasyAllow* names are reserved for these generated relations.

Automatic action gates narrow the default CurrentDependsPolicyRelevant and ReachableFromPolicyRelevant gates. They combine demand across all actions and preserve authored gates. Positive nonrecursive prerequisites can narrow demand when their complete dependencies avoid gated helpers and recursive groups. Independent witnesses and bounded analysis can still admit extra graph traversal. This is not general recursive-program optimization, and it does not yet match every inline path or command restriction. The hand-written guard gates, ReachesRelevant gate, and ReachSink destination restrictions remain in place.

Runtime deadlines also cover generated diagnostic work. Compiled/interpreted parity tests and guard fixtures exercise selected cases; they are not a proof for arbitrary policies. See policy language for rule semantics and configuration for evaluation deadlines.

Distribution scope

The source assembly includes the gRPC policy API, not private hosted translation services or equivalence-checking pipelines. Optional Sasty source requires separate model/backend provisioning and verification. Source inclusion alone does not establish package release readiness.

See building for artifact dependencies and qualification. Maintainers must review the exported source and EXPORT-REVIEW.json before first publication; the exporter’s dependency and private-reference checks are not a complete secret scan. Security contact: npalumbo@wisc.edu.