TEND / Rules
Decide what eachagent may do.
Allow, ask,or never.
Choose per tool and add conditions on the arguments. Anything not listed is blocked, and an unreadable rule set blocks everything.
Rules for ops-agent
- Read a ticketread_ticket.read
- Send an emailsend_email.send
- Pay an invoicepay_invoice.pay
- Delete a recorddelete_record.delete
- Run a commandshell.run
Anything not listed is blocked. Paying always asks first.
Test a call
The rule says Ask me first. Nothing runs until you answer.
Rules for one agent
Change a rule, then test a call against it. Paying is locked to Ask me first.
How rules decideSend an email
send_email: Allow when the address ends in @yourco.example, otherwise Ask me first
Type an address to see the decision.
Conditions on arguments
Allow emails only to your own domain. Type an address and see what TEND decides.
Read the docsBaseline
Assigned to 3 agents
In force for every assigned agent now. An agent’s own rules can make it stricter, never looser.
One policy, many agents
A central policy applies to every agent assigned to it, from the moment it changes.
How it worksFrom your terminal
Set rules fromyour terminal.
Create a central policy, assign agents, and see what a change would have decided before you save it.
Read the docs$ npm run tend -- policy create "Baseline" --rule send_email:send:approve --rule delete_record:delete:deny --assign "ops-agent" Created "Baseline" v1: send_email.send=approve, delete_record.delete=deny; agents: ops-agent $ npm run tend -- simulate "Baseline" --rule send_email:send:deny Simulated against 42 recorded action(s) from the last 30 day(s). Nothing was run or saved. would allow 30, ask 0, block 12 (it was: allowed 30, asked 12, blocked 0)
Every tool call your agents make.Checked first.
