Loading…
Open-Policy Exchange
~5 min to deploy
Copilot Agent Tool Whitelist
Only the tools you approved fire. Everything else is denied at the pre-tool boundary with a reason the agent can read.
For: Teams running the Copilot CLI or cloud agent on real repositories
SOC 2 CC7.2ISO 27001 A.8.9Client assurance
What it enforces
Approved-tool enforcement
Blocks any tool call outside the approved software list for the engagement.
Network egress gate
Escalates outbound calls to a host that is not on the allowed egress list.
Write-scope containment
Restrains writes outside the paths the engagement scope covers.
copilot-agent-tool-whitelist.yaml
# Copilot Agent Tool Whitelist
# Fork: this is the ai_agency "Tool-Use Whitelist" gate, wired at the
# preToolUse boundary in .github/hooks/*.json.
apiVersion: decionis.dev/v1
kind: PolicyPack
metadata:
name: copilot-agent-tool-whitelist
surface: copilot
standards: [SOC2-CC7.2, ISO27001-A.8.9]
defaults:
mode: shadow
emit_dossier: true
fail_closed: true
approved_tools: [read, edit, search, run_tests, open_pull_request]
allowed_egress_hosts: ["api.github.com", "registry.npmjs.org"]
rules:
- name: approved_tool_enforcement
when: "always"
decision: |
BLOCK IF tool not in approved_tools
ALLOW OTHERWISE
reason_code: tool_not_on_approved_list
- name: network_egress_gate
when: "tool_call.egress_host != null"
decision: |
ESCALATE IF tool_call.egress_host not in allowed_egress_hosts
ALLOW OTHERWISE
reason_code: egress_host_not_allowed
- name: write_scope_containment
when: "tool in ['edit', 'write']"
decision: |
RESTRAIN IF not path.startswith(engagement.scope_root)
ALLOW OTHERWISE
reason_code: write_outside_engagement_scope
Fork it, change the thresholds to match your environment, and deploy in shadow mode first — it defaults to listen-only so nothing in your live pipeline changes.
How to install it
Follow the install path for this surface, then paste the forked YAML as your policy config.