Quickstart

npm install tealtiger

import { TealEngine, OWASPPolicyPack } from 'tealtiger';
import { v4 as uuid } from 'uuid';

// Option A: Zero-config with OWASP Policy Pack (covers all 10 ASI risks)
const engine = new TealEngine({
  policy: OWASPPolicyPack.default(),
  modules: OWASPPolicyPack.modules(),
  mode: 'ENFORCE',
});

// Option B: Custom policy
const engine = new TealEngine({
  policy: {
    rules: [
      // Block file deletion in production
      {
        condition: { action: 'file.delete', environment: 'production' },
        automation: 'auto_deny',
      },
      // Require approval for payments over $100
      {
        condition: { action: 'payment.*', amount: { gt: 100 } },
        automation: 'approval_required',
        approval: { approvers: ['[email protected]'], timeout: '10m' },
      },
      // Allow read operations
      {
        condition: { action: '*.read' },
        automation: 'auto_allow',
      },
    ],
  },
  // Immutable safety controls (cannot be bypassed by application code)
  freeze: [
    {
      id: 'FREEZE-001',
      condition: { action: 'database.drop' },
      reason: 'FREEZE_DATABASE_DROP',
    },
  ],
  mode: 'ENFORCE',
});

async function executeAgentAction(action: string, params: Record<string, any>) {
  // Evaluate the action against governance policy
  const decision = await engine.evaluate(
    {
      action,
      toolParams: params,
      environment: 'production',
    },
    {
      correlation_id: uuid(),
      agentId: 'support-bot-001',
    }
  );

  // Handle the decision
  switch (decision.action) {
    case 'ALLOW':
      console.log(`✅ Allowed: ${action}`);
      return await performAction(action, params);

    case 'DENY':
      console.log(`🚫 Denied: ${action} — ${decision.reason_codes.join(', ')}`);
      throw new Error(`Action denied: ${decision.reason_codes[0]}`);

    case 'PENDING':
      console.log(`⏳ Awaiting approval: ${action}`);
      // Hold until human approves
      return { status: 'pending', token: decision.approval.token };

    case 'MODIFY':
      console.log(`✏️ Modified: ${action} — content sanitized`);
      return await performAction(action, decision.metadata.sanitized_params);
  }
}

// Try it:
await executeAgentAction('customer.read', { id: 'cust-123' });
// ✅ Allowed: customer.read

await executeAgentAction('file.delete', { path: '/etc/config' });
// 🚫 Denied: file.delete — POLICY_VIOLATION

await executeAgentAction('database.drop', { table: 'users' });
// 🚫 Denied: database.drop — FREEZE_DATABASE_DROP