Policy DSL

YAML rules that control what your AI agents can and can’t do.

Quint’s policy engine evaluates every tool call against a set of YAML rules before the tool executes. If a rule matches, the SDK blocks the call and raises ToolBlockedError.

Default policy

The SDK ships with a built-in policy that blocks common dangerous patterns:

rules:
  - name: block_dotenv_reads
    action: block
    reason: ".env files often contain secrets"
    when:
      - op: contains
        path: args.path
        value: .env

  - name: block_aws_credentials
    action: block
    reason: "AWS credentials must not be exposed to AI agents"
    when:
      - op: regex
        path: args.path
        pattern: '\.aws/credentials$'

  - name: block_destructive_shell
    action: block
    reason: "Destructive shell commands are not allowed"
    when:
      - op: equals
        path: tool_name
        value: shell
      - op: regex
        path: args.command
        pattern: 'rm\s+-rf\s+/'

Custom policy

Pass a YAML file or dict to quint.init():

# From a file
quint_agent.init(api_key="qak_...", policy="policy.yaml")

# From a dict
quint_agent.init(api_key="qak_...", policy={
    "rules": [
        {
            "name": "block-prod-db",
            "action": "block",
            "reason": "No production database access",
            "when": [
                {"op": "contains", "path": "args.connection_string", "value": "prod"}
            ]
        }
    ]
})

Rule structure

rules:
  - name: rule-id           # unique identifier
    action: block | escalate # block = raise error, escalate = allow but flag
    reason: "Human-readable explanation"
    when:                    # ALL conditions must match (AND logic)
      - op: equals | contains | regex
        path: tool_name | args.{key}
        value: "exact match"          # for equals/contains
        pattern: "regex pattern"      # for regex

Matchers

Operator	Description	Example
equals	Exact string match	tool_name equals "delete_file"
contains	Substring match	args.path contains ".env"
regex	Regular expression	args.command matches 'rm\s+-rf'

Path expressions

The path field accesses the tool call context:

Path	Value
tool_name	The name of the tool being called
args.{key}	Any argument passed to the tool
args.path	Common: file path argument
args.command	Common: shell command argument
args.url	Common: URL argument
args.query	Common: database query argument

Examples

Block all file writes to /etc

- name: block-etc-writes
  action: block
  reason: "System files are read-only"
  when:
    - op: equals
      path: tool_name
      value: write_file
    - op: regex
      path: args.path
      pattern: '^/etc/'

Block network calls to internal APIs

- name: block-internal-api
  action: block
  reason: "Internal APIs are off-limits"
  when:
    - op: regex
      path: args.url
      pattern: '(internal\.|\.local|10\.\d+\.\d+\.\d+|192\.168\.)'

Escalate (allow but flag) database mutations

- name: flag-db-mutations
  action: escalate
  reason: "Database mutations require review"
  when:
    - op: regex
      path: args.query
      pattern: '(?i)(INSERT|UPDATE|DELETE|DROP|ALTER|TRUNCATE)'

Block pip install in production

- name: block-pip-install
  action: block
  reason: "Package installation not allowed in production"
  when:
    - op: equals
      path: tool_name
      value: run_command
    - op: regex
      path: args.command
      pattern: 'pip\s+install'