Skip to content

Ruleset templates

Start from known runtime rules.
Full enforcement in seconds.

Pre-built rulesets for common agent profiles. Load a template, customize the boundaries, and add Workflow Gates when the agent needs ordered process with evidence and approvals.

Built-in templates

Rulesets are one primitive.

file-agent

3 rules

Block sensitive file reads and destructive bash commands

guard = Edictum.from_template( "file-agent")
  • Block reads to /etc/passwd, /etc/shadow, .env
  • Block destructive bash: rm -rf, sudo, curl|sh
  • Sandbox file access to workspace directory

research-agent

3 rules

Session limits and PII detection for research workflows

guard = Edictum.from_template( "research-agent")
  • Session limit: 100 tool calls, 200 attempts
  • PII detection in tool output (SSN, email, phone)
  • Rate limit web_search to 20 calls per session

devops-agent

6 rules

Production deploy gates, ticket requirements, role checks

guard = Edictum.from_template( "devops-agent")
  • Require ticket reference for production deploys
  • Block kubectl delete in production namespace
  • Role check: only SRE can run destructive ops
  • Credential protection: redact AWS keys, tokens

nanobot-agent

5 rules

HITL approvals for shell exec, sub-agent spawning, MCP tools

guard = Edictum.from_template( "nanobot-agent")
  • Human-in-the-loop approval for shell_exec with dangerous patterns
  • Block sub-agent spawning without rules
  • Human-in-the-loop approval for unknown MCP tool servers
  • Secret redaction from all tool output
  • Session limits: 10 shell, 5 spawn, 100 total

Industry scenarios

Compose with the frameworks you already use.

Pharma

LangGraph + FastAPI

Clinical trial data management with AI agents

  • Role-based access: researcher vs monitor vs admin
  • PII redaction: patient IDs, names, DOBs
  • Unblinding prevention: treatment arm access blocked
HIPAAGxP21 CFR Part 11

Fintech

CrewAI + FastAPI

Automated trading and portfolio management

  • Trade amount limits ($50K threshold)
  • Account access by role: trader vs analyst
  • Mandatory compliance report generation
  • 4 roles: trader, analyst, compliance, admin
SOXMiFID IISEC

DevOps

OpenAI Agents + MCP

Infrastructure automation with AI agents

  • Block destructive: rm -rf, DROP TABLE
  • Credential protection: redact AWS/GCP keys
  • Production deploy gates with ticket refs
  • Environment-aware: staging vs production rules
SOC 2ISO 27001

Customer Support

LangChain + Nanobot

AI-powered customer service agents

  • PII redaction in all responses
  • Refund limit: $100 auto, above needs approval
  • Billing system access restricted by role
  • Escalation rules for sensitive topics
GDPRPCI-DSS
my-agent.yamledictum/v1
apiVersion: edictum/v1
kind: Ruleset

metadata:
  name: my-agent

defaults:
  mode: enforce

rules:
  - id: block-sensitive-files
    type: pre
    tool: read_file
    when:
      args.path:
        contains_any:
          - '.env'
          - '/etc/passwd'
    then:
      action: block
      message: "Access to sensitive file blocked."
      tags: [security, files]

Custom rules

Custom rules in minutes.

apiVersion

Always edictum/v1. Versioned schema for forward compatibility.

kind

Ruleset — one or more rules in a single file.

defaults

Set enforce or observe mode for every rule in the ruleset.

rules

Array of rules: type, tool, when conditions, then actions.

15 operators

equals, matches, contains, gt/lt, exists, regex, and more. Plus custom operators.

Boolean logic

Combine conditions with all, any, not. Nest them for complex rules.

Side-effect classification

Tools marked as PURE, READ, WRITE, or IRREVERSIBLE. Postconditions adapt accordingly.

Skills file

Coming soon — AI agents will generate rules for your specific setup.

Full ruleset reference

Start enforcing rules today.

pip install edictum[yaml]
Read the DocsView on GitHub