// =============================================================
// CSL-Core Example: Agent Tool Guard (v0.1)
// Goal: Deterministic permission + parameter safety for AI agents
// =============================================================
CONFIG {
ENFORCEMENT_MODE: BLOCK
CHECK_LOGICAL_CONSISTENCY: TRUE
ENABLE_FORMAL_VERIFICATION: FALSE
ENABLE_CAUSAL_INFERENCE: FALSE
INTEGRATION: "native"
}
DOMAIN AgentToolGuard {
VARIABLES {
// Who is requesting / operating the agent
user_role: {"ADMIN", "USER", "ANALYST"}
// Which tool the agent is about to call
tool: {"SEND_EMAIL", "TRANSFER_FUNDS", "QUERY_DB", "DELETE_RECORD"}
// Optional, tool-dependent parameters
amount: 0..100000
recipient_domain: {"INTERNAL", "EXTERNAL"}
db_table: {"CUSTOMERS", "TRANSACTIONS", "SECRETS"}
pii_present: {"YES", "NO"}
approval_token: {"YES", "NO"}
}
// -----------------------------------------------------------
// 1) Non-admin users must never perform money transfers
// -----------------------------------------------------------
STATE_CONSTRAINT non_admin_no_transfer {
WHEN user_role == "USER" OR user_role == "ANALYST"
THEN tool MUST NOT BE "TRANSFER_FUNDS"
}
// -----------------------------------------------------------
// 2) Money transfers require an explicit approval token
// (Simulates "human-in-the-loop" gate or signed approval)
// -----------------------------------------------------------
STATE_CONSTRAINT transfer_requires_approval {
// Only applies to ADMIN transfers.
// Non-admin transfers are already forbidden by non_admin_no_transfer.
WHEN tool == "TRANSFER_FUNDS" AND user_role == "ADMIN"
THEN approval_token == "YES"
}
// -----------------------------------------------------------
// 3) Even admins have a hard transfer limit per action
// -----------------------------------------------------------
STATE_CONSTRAINT admin_transfer_limit {
WHEN tool == "TRANSFER_FUNDS" AND user_role == "ADMIN"
THEN amount <= 5000
}
// -----------------------------------------------------------
// 4) If PII is present, agent may only email INTERNAL recipients
// -----------------------------------------------------------
STATE_CONSTRAINT no_external_email_with_pii {
WHEN tool == "SEND_EMAIL" AND pii_present == "YES"
THEN recipient_domain MUST NOT BE "EXTERNAL"
}
// -----------------------------------------------------------
// 5) Restrict high-risk DB access: SECRETS table is forbidden
// -----------------------------------------------------------
STATE_CONSTRAINT no_secrets_table_queries {
WHEN tool == "QUERY_DB"
THEN db_table MUST NOT BE "SECRETS"
}
// -----------------------------------------------------------
// 6) Dangerous destructive tool calls must never happen
// (Hard-ban DELETE_RECORD for this alpha example)
// -----------------------------------------------------------
STATE_CONSTRAINT no_delete_record_tool {
ALWAYS True
THEN tool MUST NOT BE "DELETE_RECORD"
}
}
