---
title: "Coding Agent Policy Gate"
canonical: https://trickest.com/library/coding-agent-policy-gate
description: "Decide allow, alert, or block on coding-agent file, shell, and network actions with AgentsLeak rules and a GolemHalt Cedar/YARA corpus."
---

# Coding Agent Policy Gate

## Overview

Coding agents read files, run shells, and open network connections on the operator's machine. A reverse shell, an `.env` read, or an exfil curl is a policy decision that has to land before the action runs, not after a ticket. Pattern and sequence rules plus a Cedar/YARA reference-monitor corpus are the floor for that gate.

This is a standing check for [continuous security testing](/use-cases/continuous-security-testing). You seed demo agent-action events, evaluate them with AgentsLeak, inventory the GolemHalt Cedar/YARA corpus, and correlate allow, alert, and block decisions you can schedule as a retest delta when policies or hooks change.

It sits next to [Web AI Agent Audit](/library/web-ai-agent-audit) (embedded web agents) and [MCP Trust Boundary Suite](/library/mcp-trust-boundary-suite) (MCP server config). This Collection unit is the coding-agent action path: event JSON in, policy decisions out. Default Seed needs no live Claude or Cursor session. Replace it with your hook captures.

## Pipeline

1. Seed · Demo agent-action events writes fixture JSON under `events/` (`.env` and SSH key reads, exfil curl, reverse shell, clean `ls`).
2. Scan · AgentsLeak evaluate runs pattern and sequence policy decisions with `mode=evaluate`.
3. Scan · GolemHalt policy corpus inventories Cedar and YARA reference-monitor paths.
4. Results · Correlate merges findings, inventory, remediation, and retest_delta outputs.

## Inputs

- **Seed events folder.** Default demo JSON. Replace with Claude Code or Cursor hook captures. Each event needs a `category` plus `metadata.file_path`, `metadata.command`, or `metadata.url` as relevant.
- **AgentsLeak mode.** Default `evaluate` (uses Seed). `fixture` ignores Seed and runs the built-in demo pack. `policies` inventories rules only.
- **GolemHalt corpus.** Private vault Arsenal tool. No extra operator input on the smoke path.

## Outputs

- **findings.jsonl.** ALLOW, ALERT, and BLOCK decisions with rule id and remediation.
- **inventory.jsonl.** Rules, decisions, categories, and Cedar paths observed.
- **summary.jsonl.** Rollup for the correlate pass (`evidence_bar`, `decisions`).
- **retest_delta.jsonl.** Schedule-as-diff scaffold when the policy pack or hooks change.

## Integrations

- [AgentsLeak](/tools/agentsleak) (BHUSA 2026 Arsenal)
- [GolemHalt](/tools/golemhalt) (BHUSA 2026 Arsenal)

## Sample output

Sample shape from the correlate pack on demo seed events (illustrative, not a live KPI).

```jsonl
{"kind":"finding","decision":"BLOCK","title":"Reverse-shell or exfil sequence on a coding-agent action","severity":"critical"}
{"kind":"finding","decision":"ALERT","title":"Sensitive file read (.env or SSH key)","severity":"high"}
{"kind":"inventory","note":"Cedar or YARA policy path observed from GolemHalt"}
{"kind":"retest_delta","note":"Schedule re-runs when the policy pack or agent hooks change"}
```

## FAQ

### Do I need a live Claude or Cursor session?

No. Default Seed evaluates demo events. Replace Seed with your hook captures and keep AgentsLeak on `mode=evaluate`.

### What does AgentsLeak mode change?

`evaluate` scores the events you feed it. `fixture` ignores Seed and runs the built-in demo pack. `policies` inventories rules without deciding on events.

### Why schedule this?

Correlate emits `retest_delta.jsonl` so scheduled re-runs can surface policy or hook drift after you change the pack or the agent.

## Related workflows

- [Web AI Agent Audit](/library/web-ai-agent-audit). Reach for this instead when the surface is an embedded web chat agent, not coding-agent actions on the operator machine.
- [MCP Trust Boundary Suite](/library/mcp-trust-boundary-suite). Reach for this instead when the surface is MCP server config, not agent-action events.
- [CICD Attack Surface Scanner](/library/cicd-attack-surface-scanner). Reach for this instead when the job is Actions YAML trust, not runtime agent-action policy.

---
_Markdown source of https://trickest.com/library/coding-agent-policy-gate._