@jiffylabs/agentgateway-policy-pack

Reference CEL (Common Expression Language) policy pack for agentgateway. Maps Jiffy trust tiers + AIL (agentic impact level) thresholds to declarative permit | warn | block rules. Pairs with @jiffylabs/agentgateway-adapter for live webhook enforcement.

Sprint 53 ships 8 seed bundles and a small in-tree CEL validator covering the frozen subset used by the bundles. No runtime dependency on a full CEL parser — the validator and evaluator share a tiny recursive-descent parser over a documented grammar.

Install

pnpm add @jiffylabs/agentgateway-policy-pack

Programmatic use

import {
  policies,
  findPolicy,
  validate,
  parse,
  evaluate,
  tokenize,
} from '@jiffylabs/agentgateway-policy-pack';

const p = findPolicy('critical-only');
const ast = parse(tokenize(p!.cel));
const verdict = evaluate(ast, {
  decision: { tier: 'CRITICAL', ail_level: 5 },
});
// verdict === 'block'

Per-bundle subpath imports are also available:

import { policy } from '@jiffylabs/agentgateway-policy-pack/policies/malicious-block';

Seed bundles

| slug | default_decision | framework_codes | | ----------------------------- | ---------------- | ------------------------------------------------ | | malicious-block | permit | OWASP-Agentic-2026, MITRE-ATLAS | | critical-only | permit | OWASP-Agentic-2026, NIST-CSF-2.0 | | finance-restricted | permit | SOC2-CC6.1, OWASP-Agentic-2026, NIST-CSF-2.0 | | dev-permissive | warn | (none — dev sandbox, not a compliance posture) | | agentic-only-with-approval | permit | OWASP-Agentic-2026, NIST-CSF-2.0 | | tier1-only | block | SOC2-CC6.1, NIST-CSF-2.0 | | framework-codes-soc2 | permit | SOC2-CC6.1, OWASP-Agentic-2026, NIST-CSF-2.0 | | blast-radius-guard | permit | OWASP-Agentic-2026, MITRE-ATLAS |

CEL subset (Sprint 53, frozen)

• Literals: integer, string ("..."), boolean.
• Equality: ==, !=.
• Ordering: <, <=, >, >= (integers only).
• Membership: in (right side is a list literal).
• Logical: &&, ||, !.
• Ternary: cond ? a : b.
• Dotted field access: decision.tier, request.mcp_server, jiffy.* (reserved).
• Single string-indexed access: request.headers["X-Agent-Id"].
• Builtins: startsWith(s, prefix), contains(s, substr), has(path).

Anything outside this subset is a CEL_VALIDATION_ERROR. Any bundle needing more expressiveness should be simplified, not grown.

Identifier reference

• decision.tier — one of TRUSTED | CAUTION | RISKY | CRITICAL | PENDING.
• decision.ail_level — integer 0..5.
• decision.jts_score — integer 0..100.
• decision.framework_codes — list of compliance codes (e.g. SOC2-CC6.1).
• decision.parent_invalidated — boolean (blast-radius flag).
• request.tool — tool name.
• request.agent — agent identity object.
• request.mcp_server — MCP server hostname / deployment label.
• request.headers["X-*"] — string header values.

Paste-in for agentgateway

Emit an agentgateway-flavored YAML snippet for any bundle via the CLI:

jiffy export-agentgateway-policy malicious-block

See docs/integrations/agentgateway.md for the full how-to.

License

Apache-2.0 © Jiffy Labs