Loading…
Open-Policy Exchange
~7 min to deploy
Vertex AI Tool-Execution Gate
Gates the extension call a Vertex AI model wants to make, so an out-of-scope or unapproved tool never executes.
For: Teams running governed execution through the Vertex AI extension surface
SOC 2 CC7.2ISO 27001 A.8.9Agent action evidence
What it enforces
Approved-extension check
Blocks an extension call outside the approved list for the project.
Scope containment
Blocks a call whose target falls outside the agent's declared scope.
Human-approval requirement
Escalates when the call carries a requires-human-approval flag.
vertex-ai-tool-execution-gate.yaml
# Vertex AI Tool-Execution Gate
# Fork: list the extensions your project actually approves.
apiVersion: decionis.dev/v1
kind: PolicyPack
metadata:
name: vertex-ai-tool-execution-gate
surface: vertex_ai
standards: [SOC2-CC7.2, ISO27001-A.8.9]
defaults:
mode: shadow
emit_dossier: true
fail_closed: true
approved_extensions: [code_interpreter, vertex_ai_search, internal_lookup]
rules:
- name: approved_extension_check
when: "action == 'extension.execute'"
decision: |
BLOCK IF extension.id not in approved_extensions
ALLOW OTHERWISE
reason_code: extension_not_approved
- name: scope_containment
when: "action == 'extension.execute'"
decision: |
BLOCK IF outside_scope == true
ALLOW OTHERWISE
reason_code: call_outside_agent_scope
- name: human_approval_requirement
when: "action == 'extension.execute'"
decision: |
ESCALATE IF requires_human == true
ALLOW OTHERWISE
reason_code: call_requires_human_approval
Fork it, change the thresholds to match your environment, and deploy in shadow mode first — it defaults to listen-only so nothing in your live pipeline changes.
How to install it
Follow the install path for this surface, then paste the forked YAML as your policy config.