Coding Agent Policy Gate

Overview

Coding agents read files, run shells, and open network connections on the operator's machine. A reverse shell, an .env read, or an exfil curl is a policy decision that has to land before the action runs, not after a ticket. Pattern and sequence rules plus a Cedar/YARA reference-monitor corpus are the floor for that gate.

This is a standing check for continuous security testing. You seed demo agent-action events, evaluate them with AgentsLeak, inventory the GolemHalt Cedar/YARA corpus, and correlate allow, alert, and block decisions you can schedule as a retest delta when policies or hooks change.

It sits next to Web AI Agent Audit (embedded web agents) and MCP Trust Boundary Suite (MCP server config). This Collection unit is the coding-agent action path: event JSON in, policy decisions out. Default Seed needs no live Claude or Cursor session. Replace it with your hook captures.

Pipeline

1. Seed · Demo agent-action events writes fixture JSON under events/ (.env and SSH key reads, exfil curl, reverse shell, clean ls).
2. Scan · AgentsLeak evaluate runs pattern and sequence policy decisions with mode=evaluate.
3. Scan · GolemHalt policy corpus inventories Cedar and YARA reference-monitor paths.
4. Results · Correlate merges findings, inventory, remediation, and retest_delta outputs.

Inputs

• Seed events folder. Default demo JSON. Replace with Claude Code or Cursor hook captures. Each event needs a category plus metadata.file_path, metadata.command, or metadata.url as relevant.
• AgentsLeak mode. Default evaluate (uses Seed). fixture ignores Seed and runs the built-in demo pack. policies inventories rules only.
• GolemHalt corpus. Private vault Arsenal tool. No extra operator input on the smoke path.

Outputs

• findings.jsonl. ALLOW, ALERT, and BLOCK decisions with rule id and remediation.
• inventory.jsonl. Rules, decisions, categories, and Cedar paths observed.
• summary.jsonl. Rollup for the correlate pass (evidence_bar, decisions).
• retest_delta.jsonl. Schedule-as-diff scaffold when the policy pack or hooks change.

Integrations

• AgentsLeak (BHUSA 2026 Arsenal)
• GolemHalt (BHUSA 2026 Arsenal)

Sample output

Sample shape from the correlate pack on demo seed events (illustrative, not a live KPI).

kind	decision	title	severity	note
finding	BLOCK	Reverse-shell or exfil sequence on a coding-agent action	critical	null
finding	ALERT	Sensitive file read (.env or SSH key)	high	null
inventory	null	null	null	Cedar or YARA policy path observed from GolemHalt
retest_delta	null	null	null	Schedule re-runs when the policy pack or agent hooks change

FAQ

Do I need a live Claude or Cursor session?

No. Default Seed evaluates demo events. Replace Seed with your hook captures and keep AgentsLeak on mode=evaluate.

What does AgentsLeak mode change?

evaluate scores the events you feed it. fixture ignores Seed and runs the built-in demo pack. policies inventories rules without deciding on events.

Why schedule this?

Correlate emits retest_delta.jsonl so scheduled re-runs can surface policy or hook drift after you change the pack or the agent.

Related workflows

• Web AI Agent Audit. Reach for this instead when the surface is an embedded web chat agent, not coding-agent actions on the operator machine.
• MCP Trust Boundary Suite. Reach for this instead when the surface is MCP server config, not agent-action events.
• CICD Attack Surface Scanner. Reach for this instead when the job is Actions YAML trust, not runtime agent-action policy.