plugins:
- name: "CedarPolicyPlugin"
kind: "cedarpolicyplugin.plugin.CedarPolicyPlugin"
description: "A plugin that does policy decision and enforcement using cedar"
version: "0.1.0"
author: "Shriti Priya"
hooks: ["prompt_pre_fetch", "prompt_post_fetch", "tool_pre_invoke", "tool_post_invoke"]
tags: ["plugin"]
mode: "enforce" # enforce | permissive | disabled
priority: 150
conditions:
# Apply to specific tools/servers
- server_ids: [] # Apply to all servers
tenant_ids: [] # Apply to all tenants
config:
policy_lang: cedar
policy_output_keywords:
view_full: "view_full_output"
view_redacted: "view_redacted_output"
policy_redaction_spec:
pattern: '"\$\d{1,}(,\d{1,})*"' # provide regex, if none, then replace all
policy:
- id: allow-employee-basic-access
effect: Permit
principal: Role::"employee"
action:
- Action::"get_leave_balance" #tool name
- Action::"request_certificate"
resource:
- Server::"askHR" # mcp-server name
- Agent::"employee_agent" # agent name
- id: allow-manager-full-access
effect: Permit
principal: Role::"manager"
action:
- Action::"get_leave_balance"
- Action::"approve_leave"
- Action::"promote_employee"
- Action::"view_performance"
- Action::"view_full_output"
resource:
- Agent::"manager_agent"
- Server::"payroll_tool"
- id: allow-hr-hr_tool
effect: Permit
principal: Role::"hr"
action:
- Action::"update_payroll"
- Action::"view_performance"
- Action::"view_full_output"
resource: Server::"hr_tool"
- id: redact-non-manager-views
effect: Permit
principal: Role::"employee"
action: Action::"view_redacted_output"
resource:
- Server::"payroll_tool"
- Agent::"manager_agent"
- Server::"askHR"
- id: allow-admin-resources # policy for resources
effect: Permit
principal: Role::"admin"
action:
- Action::"view_full_output"
resource: Resource::""https://example.com/data"" #Resource::<resource_uri>
- id: allow-employee-redacted-resources # policy for resources
effect: Permit
principal: Role::"employee"
action:
- Action::"view_redacted_output"
resource: Resource::""https://example.com/data"" #Resource::<resource_uri>
- id: allow-admin-prompts # policy for resources
effect: Permit
principal: Role::"admin"
action:
- Action::"view_full_output"
resource: Prompts::"judge_prompts" #Prompt::<prompt_name>
- id: allow-employee-redacted-prompts # policy for resources
effect: Permit
principal: Role::"employee"
action:
- Action::"view_redacted_output"
resource: Prompts::"judge_prompts" #Prompt::<prompt_name>
# Plugin directories to scan
plugin_dirs:
- "cedarpolicyplugin"
# Global plugin settings
plugin_settings:
parallel_execution_within_band: true
plugin_timeout: 30
fail_on_plugin_error: false
enable_plugin_api: true
plugin_health_check_interval: 60
include_user_info: true
