One door for every tool, with rules

Route every tool call through one function that knows who is calling, which tool and with what

Run this to check

You pass when

A test passes showing that no tool can be reached without going through the gateway.

Files you write

• gateway.py
• tests/test_gateway.py

Write three rules: support staff cannot pay, refunds over 100 need a person, everyone can look up a parcel

Rules in a file can be read and signed off by someone who does not read code. Larger teams use a policy language such as Cedar for the same job.

Run this to check

You pass when

Tests pass for one allow, one deny and one needs-approval case.

Files you write

• policy.yaml
• tests/test_policy.py

Call a tool that no rule mentions

Run this to check

You pass when

It is denied. Anything not allowed by a rule is refused.

Files you write

• tests/test_policy.py

Record every decision with its reason

Run this to check

You pass when

One line per call: who, tool, decision and the rule that decided it.

Files you write

• audit.jsonl