signet-eval — Deterministic Policy Enforcement for AI Agents
Description: Enforce spending limits, block destructive commands, and control what AI agents can do. 5ms cold start. No LLM in the authorization path.

# signet-eval

Deterministic policy enforcement for AI agents. Control what your agent can do — spending limits, destructive command blocking, credential gating — without putting an LLM in the decision path.

5ms
cold start
<1μs
policy eval
44
tests
14
condition functions

    cargo install signet-eval

## Three Steps

1. Install: `cargo install signet-eval`

2. Hook into Claude Code:

    {
      "hooks": {
        "PreToolUse": [{
          "matcher": "",
          "hooks": [{"type": "command", "command": "signet-eval", "timeout": 2000}]
        }]
      }
    }

3. Done. Every tool call now passes through policy evaluation.

## Default Policy

Action | Decision
--- | ---
`rm`, `rmdir` | DENY
`git push --force` | ASK
`mkfs`, `format`, `dd if=` | DENY
`curl | sh`, `wget | sh` | DENY
Write to `.env`, `.pem`, `.key` | DENY
`chmod 777` | ASK
Everything else | ALLOW

## Custom Rules

    # ~/.signet/policy.yaml
    version: 1
    default_action: ALLOW
    rules:
      - name: books_limit
        tool_pattern: ".*purchase.*"
        conditions:
          - "param_eq(category, 'books')"
          - "spend_plus_amount_gt('books', amount, 200)"
        action: DENY
        reason: "Books spending limit ($200) exceeded"

      - name: block_sudo
        tool_pattern: ".*"
        conditions: ["param_contains(command, 'sudo')"]
        action: ASK
        reason: "sudo requires confirmation"

## Condition Functions

Function | Description
--- | ---
`contains(parameters, 'X')` | Tool input contains string
`any_of(parameters, 'X', 'Y')` | Any string present
`param_eq(field, 'value')` | Field equals value
`param_ne(field, 'value')` | Field not equal
`param_gt(field, N)` | Field > number
`param_lt(field, N)` | Field < number
`param_contains(field, 'X')` | Field contains substring
`matches(field, 'regex')` | Field matches regex
`has_credential('name')` | Credential exists in vault
`spend_gt('cat', N)` | Session spend exceeds limit
`spend_plus_amount_gt('cat', field, N)` | Cumulative spend + amount exceeds limit
`not(condition)` | Negate any condition
`or(A || B)` | Either condition true
`true` / `false` | Literal boolean

## Features

### Encrypted Vault

Argon2 + AES-256-GCM. Three tiers: public ledger, session-encrypted state, compartment-encrypted credentials. Your CC number is stored where the agent can't read it.

### Spending Limits

Track cumulative spend per category. "Don't spend more than $200 on books" just works — the vault ledger enforces it across every tool call.

### MCP Management

Manage policies by talking to Claude. "Add a $50 limit for amazon orders." 12 MCP tools for rules, credentials, status, and testing.

### MCP Proxy

Wrap upstream MCP servers with enforcement. The agent connects to the proxy, not directly to servers. No bypass possible.

### Policy Testing

`signet-eval test '{"tool_name":"Bash","tool_input":{"command":"rm foo"}}'` — test rules without running as a hook.

### Adversarial Testing

44 tests including Goodhart tests: unicode homoglyphs, null bytes, 1MB inputs, SQL injection in conditions, 1000-rule performance bounds.

## Architecture

Part of the Signet personal sovereign agent stack. The core principle: the authorization layer must not be an LLM. It processes structured data only. No natural language, no context window, no persuasion surface. A rule either matches or it doesn't.

    Agent proposes action  ->  signet-eval evaluates policy  ->  allow / deny / ask
                               (deterministic, 5ms, no NLP)

## All Commands

Command | Purpose
--- | ---
`signet-eval` | Hook evaluation (default, 5ms)
`signet-eval init` | Write default policy file
`signet-eval rules` | Show current rules
`signet-eval validate` | Check policy for errors
`signet-eval test '<json>'` | Test a tool call
`signet-eval setup` | Create encrypted vault
`signet-eval unlock` | Refresh vault session
`signet-eval status` | Vault status and spending
`signet-eval store <n> <v>` | Store Tier 3 credential
`signet-eval log` | Recent action log
`signet-eval serve` | MCP management server
`signet-eval proxy` | MCP proxy