Define what agents can do.
Faramesh evaluates every tool call against your rules before the action runs. Write policies in FPL, the Faramesh Policy Language, or in YAML or Python annotations.
Deterministic decisions before anything runs.
Faramesh evaluates every tool call against rules in code, not against a second AI watching the first. Policies are written in FPL, the Faramesh Policy Language we built for agent governance.
Same input, same output.
Faramesh evaluates rules with code, not models. No probability. No drift. Every verdict is reproducible from the same inputs.
Rules evaluate in order.
Each rule is checked top to bottom. The first one that matches decides. Predictable to read, easy to debug, no surprise interactions.
If nothing matches, nothing happens.
When no rule covers an action, the engine blocks it. Safety by default, not safety by hoping you covered every edge case.
Every decision is signed and chained.
Each verdict is hashed and linked to the previous one. You can replay any decision and prove the log was not modified after the fact.
Anatomy of a Faramesh policy.
A real payment-bot policy. Default deny, budget enforcement, phase-aware permissions, mandatory shell deny, vault-brokered credentials. Each piece tells the engine what to do at evaluation time.
agent payment-bot {
default deny
model "gpt-4o"
framework "langgraph"
budget session {
max $500
daily $2000
max_calls
on_exceed deny
}
phase intake {
permit read_customer
permit get_order
}
rules {
deny! shell/* reason: "never shell"
defer stripe/refund when amount >
notify: "finance"
reason: "high value refund"
permit stripe/* when amount <=
}
credential stripe {
backend vault
path secret/data/stripe/live
ttl
}
}- 1
agentRules evaluate per agent. Different agents, different permissions.
- 2
budgetSpend, calls, and time limits. Hits the cap, blocks the call.
- 3
phaseStage-aware permissions. Some tools only allowed during intake.
- 4
deny!Mandatory deny. Compile-time guarantee no later rule can override.
- 5
credentialVault-brokered. Issued only after the rule permits the call.
Six primitives the engine enforces.
Each card shows a single primitive in FPL. Compose them into the policies your team actually needs. Same primitives work in YAML.
Mandatory deny.
deny! is compile-time enforced. No later rule can override it. Stronger than YAML's documentation conventions.
agent default {
default deny
rules {
deny! shell/* reason: "never"
permit http/get
}
}Tool paths with globs.
Permit specific tool operations. Glob patterns match families of calls.
rules {
permit http/get
permit http/get/*
permit vault/probe/*
}Spending limits.
Cap calls per session and dollars per day. Currency is a first-class type.
budget session {
max_calls
daily $10
on_exceed deny
}Expression-aware permits.
Permits and defers can require runtime conditions. Dotted paths, equality, comparison.
rules {
permit idp/probe
when principal.verified == true
}Brokered credentials.
Bind credentials to specific tool calls. Vault issues only after policy permits.
credential vault_probe {
scope vault/probe
backend vault
max_scope payments
}Defer to a human.
Route high-impact actions to operators. Notify the right team. Block until someone decides.
defer stripe/refund
when amount >
notify: "finance"
reason: "high value refund"per simple permit, zero allocations
median latency per decision
every verdict hashed and chained
Pick the format that fits.
Same engine, three formats. FPL is canonical. YAML works as an interchange format. Code annotations let you keep policy next to the function it governs. Faramesh compiles all three to the same internal representation.
agent payment-bot {
default deny
model "gpt-4o"
framework "langgraph"
budget session {
max $500
daily $2000
on_exceed deny
}
rules {
deny! shell/* reason: "never shell"
defer stripe/refund when amount >
notify: "finance"
reason: "high value refund"
permit stripe/* when amount <=
}
credential stripe {
backend vault
path secret/data/stripe/live
ttl
}
}Describe the policy. Faramesh writes it.
Run faramesh policy compile with a plain English description. Faramesh outputs valid FPL, validates the syntax, and backtests it against your action history before activation.
# Acme support agent policy deny all shell commands, no exceptions defer refunds over $500 to a finance reviewer allow read-only http get requests by default require approval for any database write log every action with the requesting user
agent default {
default deny
rules {
permit http/get
permit http/get/*
defer stripe/refund
when amount > $500
reason: "refund routed to finance"
require_approval db/write
reason: "writes need human review"
deny! shell/*
reason: "shell commands blocked"
}
audit {
include actor_id
include timestamp
}
}Output is reviewed before activation. Backtested against real action history.
Policies are one piece.
Ship your agents to production.
Every agent you deploy deserves a policy, an audit log, and a human in the loop.
Open source. Self-hosted or cloud. No credit card required.