Policies & Security

Set up comprehensive security policies in Execlave to protect my AI agents. Here's what you need to do using the Execlave REST API: 1. Create a Prompt Injection Detection policy (blocks malicious prompts): curl -X POST https://api.execlave.com/api/v1/policies \  -H "X-API-Key: <my-api-key>" \  -H "Content-Type: application/json" \  -d '{    "name": "Block Prompt Injection",    "policyType": "injection_scan",    "enforcementMode": "block",    "ruleDefinition": { "patterns": ["ignore previous instructions", "system prompt"], "action": "block", "scan_input": true, "scan_output": true },    "appliesToAgents": [],    "isActive": true  }' 2. Create a PII Protection policy (detects and redacts personal information): curl -X POST https://api.execlave.com/api/v1/policies \  -H "X-API-Key: <my-api-key>" \  -H "Content-Type: application/json" \  -d '{    "name": "PII Protection",    "policyType": "pii_access",    "enforcementMode": "monitor",    "ruleDefinition": { "denied_pii_types": ["ssn", "credit_card"], "mask_output": true, "log_access": true },    "appliesToAgents": [],    "isActive": true  }' 3. Create a Cost Limit policy (prevents runaway spending): curl -X POST https://api.execlave.com/api/v1/policies \  -H "X-API-Key: <my-api-key>" \  -H "Content-Type: application/json" \  -d '{    "name": "Daily Cost Limit",    "policyType": "cost_limit",    "enforcementMode": "block",    "ruleDefinition": { "max_cost_per_execution": 5.0, "daily_budget": 50.0 },    "appliesToAgents": [],    "isActive": true  }' 4. Create a Monthly Budget Cap policy (enforces monthly spend limits): curl -X POST https://api.execlave.com/api/v1/policies \  -H "X-API-Key: <my-api-key>" \  -H "Content-Type: application/json" \  -d '{    "name": "Monthly Budget Cap",    "policyType": "budget_cap",    "enforcementMode": "block",    "ruleDefinition": { "monthly_cap_usd": 1000.0, "warning_threshold_pct": 80, "reset_day": 1 },    "appliesToAgents": [],    "isActive": true  }' 5. Set up pre-execution enforcement in your code. enforcePolicy() THROWS PolicyBlockedError when a block-mode policy fires — it does not return { allowed: false }. You must catch the error. // JavaScript/TypeScriptimport { ag } from './lib/execlave';import { AgentPausedError, PolicyBlockedError } from '@execlave/sdk'; async function handleMessage(input: string) {  try {    // Check policies BEFORE calling the LLM. Throws on block.    await ag.enforcePolicy({ agentId: 'my-chatbot', input });     const response = await llm.call(input);    return response;  } catch (err) {    if (err instanceof PolicyBlockedError) {      // err.violations: list of { policyType, policyName, severity, message, enforcementMode }      return 'Your input was blocked by our content policies.';    }    if (err instanceof AgentPausedError) {      return 'Service temporarily unavailable.';    }    throw err;  }} # Pythonfrom execlave import AgentPausedError, PolicyBlockedError def handle_message(user_input: str):    try:        ag.enforce_policy(agent_id="my-chatbot", input=user_input)        return llm.invoke(user_input)    except PolicyBlockedError:        return "Your input was blocked by our content policies."    except AgentPausedError:        return "Service temporarily unavailable." These policies apply to ALL agents by default (empty appliesToAgents array).To scope to specific agents, pass their UUIDs in the appliesToAgents array. IMPORTANT: tracing alone does NOT block LLM calls. Trace ingestion creates incidents post-hoc. To block requests before they reach the LLM you MUST call enforcePolicy() / enforce_policy() and handle PolicyBlockedError as shown above.