Policy Pack Library — named, framework-tagged governance packs that enforce inline

2026-07-21

securitypolicy-enginegovernance

LOCKSTEP TRACEABILITY MATRIX --- api_endpoints: ["GET /v1/security/policy-packs", "GET /v1/security/policy-packs/{id}"] sdk_methods_updated: ["regenerated via pnpm gen:contract"] mcp_tools_updated: ["none (REST-only; br_list_policy_packs is a follow-up)"] ---

What We Built

Phase 4 / step 4a. The lone L3_BASELINE_PACK becomes a real Policy Pack Library: named, versioned, framework-tagged packs a tenant can compose — prod-safety (the migrated baseline, not forked), pii-protection, eu-ai-act-high-risk (Art.14 human-oversight gates, failClosed), and nist-ai-rmf (MAP/MANAGE traceability logging). composePacks(ids) merges the selected packs into the single PolicyRuleset the middleware, engine cache, and tool-call/MCP bridges already consume — so installing a pack lights up enforcement everywhere at once.

Packs are OGP packs (the open format from the 1d SDK) — no parallel system — so a library pack can be exported to a customer, evaluated by the OSS SDK, and enforced inline by the gateway, all as the same object. Two read routes expose the catalog: GET /v1/security/policy-packs and /{id}.

Why It Matters

Credo ships a pack library too — but its packs don't gate anything. BR's packs compile to predicates that block/approve/log real requests _and_ carry the same framework/control tags for reporting. This is "beat Credo on its own spine": a framework-mapped pack that is simultaneously enforcement and evidence.

How It Works

Every pack test evaluates through the real PolicyEngine: prod-safety denies undeclared tools; eu-ai-act-high-risk requires approval for restricted-trust tool calls and deep agent chains; pii-protection gates network/exfil tools for low-trust callers; nist-ai-rmf logs autonomous actions without blocking. When packs are composed, the strictest matching rule wins by priority.

anyPackFailClosed(ids) lets a tenant governing high-risk use opt the policy infra-error boundary to fail-closed (the fail-mode decision from the roadmap).

Competitive Edge

Framework-tagged packs that actually enforce inline, exportable as the open OGP format — a documentation/registry tool cannot make its packs gate a request.

Lockstep Checklist

[x] API Routes: two read routes in security.ts, registered in _registry.ts.
[x] TS/Py SDK: regenerated via pnpm gen:contract; docs/openapi.yaml + llms-full.txt + routes.json committed.
[x] MCP Schemas: none (REST-only; br_list_policy_packs follow-up).
[ ] Master Record: update when install/uninstall routes land.

Verification & caveats

Verified: 10 pack-library unit tests including end-to-end enforcement

through the real PolicyEngine and OGP-validity of every pack; _registry gate; pnpm check + pnpm build green; full suite 9,136 passing.

Follow-ups (need live tenant-config/DB, deferred): `POST/DELETE

/v1/security/policy-packs/{id}/install (writes settings.security.policyRuleset via composePacks + invalidateTenantPolicyEngine); wiring anyPackFailClosed into policyMiddleware's fail-mode; the br_list_policy_packs` MCP tool.