Let your agents act.
You keep the veto.

Semantic tool rules, not regex.

Shell policy understands allowed_cwd_prefixes and dangerous-pattern lists. File policy enforces allowed_paths + denied extensions. HTTP gets DNS & IP allowlists plus SSRF protection.

tools:
  shell.exec:
    allowed_cwd_prefixes: ["/workspace/"]
    deny_patterns: ["rm -rf", ":(){ :|:& };:"]
    decision: approve   # human sign-off required

Append-only audit log.

Every decision — allow, deny, approval requested, approval consumed, executed — written as JSONL with actor, args (secrets redacted), risk flags, and policy hash. Daily file by default. Optional Postgres sink.

{"ts":"2026-04-22T14:03:11Z",
 "actor":"agent:finance-sync",
 "tool":"http.request",
 "decision":"approved",
 "risk":["external-api"],
 "policy_hash":"sha256:a3f9..."}

Role-based principals.

Tag agents with roles (local_dev, prod, research_readonly). Policies fork on role, so the same agent binary can be tightly caged in production and loose on your laptop — without branching the agent code.

Sensitive-boundary protection.

17 built-in rules catch an agent crossing into the macOS Keychain, SSH keys, cloud credentials, browser profiles, package-registry tokens, or .env files — even when its stated intent is benign. Override or extend any rule by id in YAML.

Framework-agnostic.

HTTP in, HTTP out. Works with the Anthropic Claude SDK, OpenAI SDK, LangChain, LlamaIndex, custom agents, and MCP servers. The repo ships a TypeScript client (@runestone-labs/gatekeeper-client), a stdio MCP server for Claude Desktop / Claude Code / Cursor, and a Claude Code hook.

USD budgets & cost audit.

Route model calls through the optional Anthropic proxy and each one is metered with real parsed token usage (cache-tier aware) — model, tokens, and USD stamped onto the audit row. /usage + /budget show actual dollars per actor, per tool, per day. Caps are per-actor (rolling guardrail) or per-run — the unit where recursive burn compounds — and deny before the upstream call. Start in soft mode, observe, then enforce at ~2× p95.

budgets:
  - name: finance-sync daily cap
    match: { actor_name: "agent:finance-sync" }
    window: day
    max_usd: 2.00        # exceeded → BUDGET_EXCEEDED
  - name: research per-run burn cap
    match: { actor_role: "research" }
    scope: run           # caps a single agentic run
    window: day
    max_usd: 5.00
    mode: soft           # observe first, then enforce

Memory, with boundaries.

Optional knowledge-graph layer: entities, episodes, relationships. Agents request memory operations just like any other tool — upserts and queries flow through the same policy engine, so you can scope which agent writes what, and audit every change.