Repository navigation
Add shared policy contract roadmap with AgentFence #117
Description
Problem
agent-kernel and AgentFence both enforce tool-call policy at different integration points: agent-kernel is embedded in-process inside an agent runtime, while AgentFence gates tool calls externally at the MCP/process boundary.
The README already explains the distinction, but adopters will want to know whether one policy intent can be expressed and verified across both layers.
Goal
Document and track the shared policy contract roadmap from the agent-kernel side.
Scope
- Map agent-kernel policy concepts to AgentFence policy concepts.
- Identify shared vs implementation-specific policy fields.
- Define portable compatibility fixtures.
- Clarify how capability tokens and in-process principal context relate to external proxy decisions.
- Identify whether shared schema/contracts belong in
weaver-spec.
Acceptance criteria
- agent-kernel docs include a shared-policy roadmap section or page.
- The docs explain how to use agent-kernel and AgentFence together without duplicating policy logic unnecessarily.
- At least one example policy intent is shown across both systems.
- Follow-up implementation/conformance issues are identified.
Activity
dgenio commentedon Jun 13, 2026
Closing as a duplicate of #116.
This issue is one of five identical "Add shared policy contract roadmap with AgentFence" issues (#116, #117, #118, #119, #120) opened by the same author within ~3 minutes on 2026-06-07, with byte-for-byte identical Problem/Goal/Scope/Acceptance sections. Consolidating all tracking onto the earliest one, #116, so the discussion isn't fragmented.
Note: the closely related implementation issue #111 ("consume the shared Policy + safety-class contract — write once, enforce embedded + at the edge") remains open and overlaps with #116's roadmap scope; a maintainer may want to fold #116 into #111 as well, but that consolidation is left open deliberately rather than assumed here.
Generated by Claude Code