feat(policy): SRS-backed per-agent guardrails (Cedar + OPA)

Adds an engine-agnostic policy abstraction at the ComputerAgent layer.
A PolicyDecider gates every tool call before the engine dispatches it;
denies short-circuit with behavior:"deny" and never reach the tool.

Why ComputerAgent-level, not per-engine: policy is the fourth orthogonal
axis alongside engine/substrate/memory. Configure once at the harness;
all engines (claude-agent-sdk, gitagent) inherit enforcement via the
existing onPermissionRequest contract — engines don't need to know about
Cedar/OPA/SRS.

How it works:
  - protocol: PolicyDecider, ToolCallContext, PolicyDecision, PolicyConfig
    types; CreateSessionBody gains an optional policy field.
  - harness-server: SrsPolicyDecider fetches the RAI policy from SRS once,
    caches cedar_guardrail + opa_guardrail, calls
    /v1/guardrails/evaluate-tool-call per turn. run-session wraps
    onPermissionRequest so a bound decider gates ahead of any client
    mediation.
  - engine-claude-agent-sdk: PreToolUse hook added so the gate fires even
    in bypassPermissions mode (where canUseTool is skipped). gitagent
    already routed preToolUse → onPermissionRequest.
  - sdk: ComputerAgent constructor accepts policy; forwarded into
    POST /v1/sessions.
  - AgentOS server: /agentos/api/policies/* proxy SRS (LYZR_API_KEY never
    reaches the browser); /agentos/api/opa-policies/* proxies SRS's
    standalone Rego policies. agent_policy_bindings collection in Mongo
    holds the per-agent policy_id binding. chat-sandbox reads the binding
    and forwards a policy spec to /sandboxes.
  - AgentOS UI: Policies page (list / create / edit / delete Cedar +
    OPA), Rego policy modal, per-agent policy tab with attach/detach.

Mirrors the shape of Lyzr's SRS guardrail-evaluate endpoint:
ToolCallContext → {allowed, deniedBy, reason}. New policy engines drop
in by implementing PolicyDecider and branching on PolicyConfig.kind in
create-session.

Verified end-to-end: claude-code denies Bash with destructive shell
patterns (OPA), Write/Edit (Cedar), WebFetch outside an allowlist (OPA);
safe Bash and allowlisted WebFetch pass through.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: patel-lyzr

agentos/src/App.tsx

@@ -4,9 +4,11 @@ import { LogsTab } from "./components/LogsTab.tsx";
 import { WorkspaceTab } from "./components/WorkspaceTab.tsx";
 import { SchedulesTab } from "./components/SchedulesTab.tsx";
 import { HomePage } from "./components/HomePage.tsx";
+import { PolicyTab } from "./components/PolicyTab.tsx";
+import { PoliciesPage } from "./components/PoliciesPage.tsx";
 
-type Tab = "chat" | "schedules" | "logs";
-type View = "home" | "dashboard";
+type Tab = "chat" | "schedules" | "policy" | "logs";
+type View = "home" | "dashboard" | "policies";
 
 function timeAgo(iso: string | null): string {
   if (!iso) return "never";
@@ -91,7 +93,7 @@ export default function App() {
             </div>
           </div>
         </div>
-        <div className="px-2 pt-2">
+        <div className="px-2 pt-2 space-y-1">
           <button
             onClick={() => setView("home")}
             className={`w-full text-left rounded-lg px-3 py-2 text-sm transition flex items-center gap-2 ${
@@ -100,6 +102,14 @@ export default function App() {
           >
             <span>🏠</span> Home
           </button>
+          <button
+            onClick={() => setView("policies")}
+            className={`w-full text-left rounded-lg px-3 py-2 text-sm transition flex items-center gap-2 ${
+              view === "policies" ? "bg-ink-600 ring-1 ring-accent/40" : "hover:bg-ink-700"
+            }`}
+          >
+            <span>🛡️</span> Policies
+          </button>
         </div>
         {/* Agents folder (file-system style) */}
         <div className="px-2 pt-2">
@@ -145,7 +155,9 @@ export default function App() {
 
       {/* Main */}
       <main className="flex-1 flex flex-col min-w-0">
-        {view === "home" ? (
+        {view === "policies" ? (
+          <PoliciesPage />
+        ) : view === "home" ? (
           <HomePage onLaunch={launchFromHome} onOpenDashboard={() => agents[0] && openAgent(agents[0].name)} />
         ) : agent ? (
           <>
@@ -161,7 +173,7 @@ export default function App() {
                 </div>
               </div>
               <nav className="ml-auto flex gap-1 bg-ink-800 rounded-lg p-1">
-                {(["chat", "schedules", "logs"] as Tab[]).map((t) => (
+                {(["chat", "schedules", "policy", "logs"] as Tab[]).map((t) => (
                   <button
                     key={t}
                     onClick={() => setTab(t)}
@@ -185,6 +197,14 @@ export default function App() {
                 />
               )}
               {tab === "schedules" && <SchedulesTab key={agent.name} agent={agent.name} agentLabel={agent.label} />}
+              {tab === "policy" && (
+                <PolicyTab
+                  key={agent.name}
+                  agent={agent.name}
+                  agentLabel={agent.label}
+                  onManagePolicies={() => setView("policies")}
+                />
+              )}
               {tab === "logs" && <LogsTab key={agent.name} agent={agent.name} />}
             </section>
           </>

agentos/src/api.ts

@@ -48,6 +48,59 @@ export interface SessionDetail {
   entries: TranscriptEntry[];
 }
 
+// Policies — SRS-managed. The browser only sees the bits that matter for
+// the runtime (name, description, cedar/opa subsections). Everything else
+// is forwarded by the server-side proxy; we don't reshape it.
+export interface CedarPolicyEntry {
+  id: string;
+  name?: string;
+  description?: string;
+  policy_text: string;
+  enabled?: boolean;
+}
+export interface CedarGuardrailConfig {
+  enabled: boolean;
+  policies: CedarPolicyEntry[];
+  fail_open?: boolean;
+}
+export interface OPAManagedBinding {
+  policy_id: string;
+  hooks?: string[];
+}
+export interface OPAGuardrailConfig {
+  enabled: boolean;
+  source: "managed" | "external";
+  managed_policies: OPAManagedBinding[];
+  server_url?: string | null;
+  policy_path?: string | null;
+  mode?: "audit" | "enforce" | "fail_open" | "fail_closed";
+  timeout_seconds?: number;
+}
+export interface PolicyDoc {
+  _id: string;
+  name: string;
+  description: string;
+  cedar_guardrail?: CedarGuardrailConfig | null;
+  opa_guardrail?: OPAGuardrailConfig | null;
+  created_at?: string;
+  updated_at?: string;
+  [k: string]: unknown;
+}
+export interface AgentPolicyBinding {
+  _id: string;          // agent name
+  policyId: string;
+  updatedAt: string;
+}
+
+export interface OPAPolicyDoc {
+  _id: string;
+  name: string;
+  description?: string;
+  rego_content: string;
+  created_at?: string;
+  updated_at?: string;
+}
+
 export interface Schedule {
   _id: string;
   agentName: string;
@@ -122,4 +175,26 @@ export const api = {
     reqJSON<{ schedule: Schedule }>("PATCH", `/schedules/${encodeURIComponent(id)}`, fields).then((d) => d.schedule),
   deleteSchedule: (id: string) => reqJSON<{ ok: boolean }>("DELETE", `/schedules/${encodeURIComponent(id)}`),
   runScheduleNow: (id: string) => postJSON<{ ok: boolean }>(`/schedules/${encodeURIComponent(id)}/run-now`, {}),
+  // Policies — SRS-proxied. Server injects x-api-key.
+  policies: () => getJSON<{ policies: PolicyDoc[] }>("/policies").then((d) => d.policies),
+  policy: (id: string) => getJSON<PolicyDoc>(`/policies/${encodeURIComponent(id)}`),
+  createPolicy: (body: Partial<PolicyDoc>) => postJSON<PolicyDoc>("/policies", body),
+  updatePolicy: (id: string, body: Partial<PolicyDoc>) =>
+    reqJSON<{ success?: boolean } | PolicyDoc>("PUT", `/policies/${encodeURIComponent(id)}`, body),
+  deletePolicy: (id: string) =>
+    reqJSON<{ success?: boolean }>("DELETE", `/policies/${encodeURIComponent(id)}`),
+  // Per-agent policy binding (Mongo, ours).
+  getAgentPolicy: (agent: string) =>
+    getJSON<{ binding: AgentPolicyBinding | null }>(`/agents/${encodeURIComponent(agent)}/policy`).then((d) => d.binding),
+  setAgentPolicy: (agent: string, policyId: string | null) =>
+    reqJSON<{ binding: AgentPolicyBinding | null }>("PUT", `/agents/${encodeURIComponent(agent)}/policy`, { policy_id: policyId }).then((d) => d.binding),
+  // OPA rego policies (managed by SRS, referenced from RAI policies' opa_guardrail).
+  opaPolicies: () => getJSON<{ policies: OPAPolicyDoc[] } | OPAPolicyDoc[]>("/opa-policies").then((d) => (Array.isArray(d) ? d : d.policies)),
+  opaPolicy: (id: string) => getJSON<OPAPolicyDoc>(`/opa-policies/${encodeURIComponent(id)}`),
+  createOpaPolicy: (body: { name: string; description?: string; rego_content: string }) =>
+    postJSON<OPAPolicyDoc>("/opa-policies", body),
+  updateOpaPolicy: (id: string, body: Partial<OPAPolicyDoc>) =>
+    reqJSON<OPAPolicyDoc | { success?: boolean }>("PUT", `/opa-policies/${encodeURIComponent(id)}`, body),
+  deleteOpaPolicy: (id: string) =>
+    reqJSON<{ success?: boolean }>("DELETE", `/opa-policies/${encodeURIComponent(id)}`),
 };