polish-academic-mcp: Instructions file for GitHub Copilot

Agent Safety & Governance

Core Principles

• Fail closed: If a governance check errors or is ambiguous, deny the action rather than allowing it
• Policy as configuration: Define governance rules in YAML/JSON files, not hardcoded in application logic
• Least privilege: Agents should have the minimum tool access needed for their task
• Append-only audit: Never modify or delete audit trail entries — immutability enables compliance

Tool Access Controls

• Always define an explicit allowlist of tools an agent can use — never give unrestricted tool access
• Separate tool registration from tool authorization — the framework knows what tools exist, the policy controls which are allowed
• Use blocklists for known-dangerous operations (shell execution, file deletion, database DDL)
• Require human-in-the-loop approval for high-impact tools (send email, deploy, delete records)
• Enforce rate limits on tool calls per request to prevent infinite loops and resource exhaustion

Content Safety

• Scan all user inputs for threat signals before passing to the agent (data exfiltration, prompt injection, privilege escalation)
• Filter agent arguments for sensitive patterns: API keys, credentials, PII, SQL injection
• Use regex pattern lists that can be updated without code changes
• Check both the user's original prompt AND the agent's generated tool arguments

Multi-Agent Safety

• Each agent in a multi-agent system should have its own governance policy
• When agents delegate to other agents, apply the most restrictive policy from either
• Track trust scores for agent delegates — degrade trust on failures, require ongoing good behavior
• Never allow an inner agent to have broader permissions than the outer agent that called it

Audit & Observability

• Log every tool call with: timestamp, agent ID, tool name, allow/deny decision, policy name
• Log every governance violation with the matched rule and evidence
• Export audit trails in JSON Lines format for integration with log aggregation systems
• Include session boundaries (start/end) in audit logs for correlation