Add demo-04 (context enforcement) and demo-05 (attribute enforcement)#20
Merged
Conversation
Demos 1-3 are the trust chain (enforce, tamper, verify). This adds a second axis: the same tool is allowed in one workflow and denied in another, so authorization tracks the declared call context rather than the tool's identity or the model's stated intent. - write_file under workflow_id="invoice-run" is permitted - the identical write_file under workflow_id="chat-freeform" is denied (default-deny; no permit matches WriteFile outside invoice-run) - read_file is permitted in any workflow (only the write capability is scoped) - both the allow and the deny are committed to the signed audit chain Uses the shared filesystem MCP server and runs software-only under CMCP_DEV_MODE=1. Wired into demo.py (option 4) and the root README. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
A third axis of enforcement alongside tool identity (demo-01) and call context (demo-04): the policy decides on the tool's compliance attributes. - write_file, read_file (compliance_domain=clinical, baa_covered=true) allowed - list_dir (compliance_domain=external-analytics, baa_covered=false) denied - the deny comes from a single guardrail: forbid ... when context.baa_covered == false, which overrides the baseline permit. One rule covers every non-BAA-covered tool in the catalog, present and future. Runtime derives compliance_domain and baa_covered from the catalog entry. Software-only under CMCP_DEV_MODE=1. Wired into demo.py (option 5) and README. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Two new runnable demos that extend the enforcement story past demo-01's tool-name gating. Demos 1-3 are the trust chain (enforce, tamper, verify); these add a second axis, showing that Cedar can decide a tool call on more than the tool's name.
write_file) is allowed underworkflow_id="invoice-run"and denied underworkflow_id="chat-freeform", same arguments. Authorization tracks the declared call context, not the model's stated intent.context.baa_covered == false) is refused by a singleforbidguardrail that overrides the baseline permit. One rule covers every non-BAA-covered tool in the catalog, present and future.Together with demo-01 they show three ways a call gets denied: by identity (name), by context (workflow), and by attribute (compliance/BAA).
How it's built
server/server.pyfilesystem tools and the established demo layout (cmcp-config.yaml,catalog.json,policies/,call.py,run.py,run.sh).CMCP_DEV_MODE=1; no hardware required.cmcp-runtime0.3.0 (Cedarpermit/forbidon action + context, signed TRACE claim). No dependence on Draft/Phase-1.5 features (response inspection, session sensitivity).demo.py(options 4 and 5) and the rootREADME.md.Test
Verified end to end against
cmcp-runtime0.3.0 on Windows (Python 3.12):python demo-04-context-enforcement/run.py— allow / 403 deny / allow, signed claim.python demo-05-compliance-domain/run.py— allow / allow / 403 deny, signed claim.python demo.py --no-pause— all five demos pass.🤖 Generated with Claude Code