icebox-gov 0.1.1

Runtime governance for autonomous offensive security — the single seam every human operator, REST client, and LLM agent must pass through before anything touches a target.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100

"""End-to-end example: govern a Python agent through the ICEBOX C ABI.

Run after building the C ABI:

    cargo build
    cd python && python examples/governed_agent.py
"""

import json
import sys
import os

sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))

from icebox import Governance


def main():
    config = {
        "charter": {
            "accepted": True,
            "engagement": "demo",
            "rules_of_engagement": ["no destruction of production"],
        },
        "scope": {"allow": ["10.0.0.0/8"]},
        "max_risk": "critical",
        "role": "admin",
        "policy_set": {
            "rules": [
                {"deny_capability": "persistence"},
                {"deny_if_cvss_above": 7.0},
            ],
            "version": 1,
        },
        "rate_limits": {},
    }

    gov = Governance(config)

    # low-risk, in-scope scan is allowed
    scan = {
        "name": "scan",
        "target": "10.0.0.5",
        "capabilities": ["network_scan"],
        "impact": "low",
        "destructive": False,
        "context": "autonomous",
    }
    print("scan verdict:", gov.check(scan))

    # persistence attempt is hard-denied by policy
    implant = {
        "name": "implant",
        "target": "10.0.0.9",
        "capabilities": ["persistence"],
        "impact": "high",
        "destructive": False,
        "context": "autonomous",
    }
    print("implant verdict:", gov.check(implant))

    # destructive, high-risk task is gated on approval (supervised)
    wipe = {
        "name": "wipe",
        "target": "10.0.0.7",
        "capabilities": ["filesystem_modification"],
        "impact": "high",
        "destructive": True,
        "context": "autonomous",
    }
    verdict = gov.check(wipe)
    print("wipe verdict:", verdict)
    needs = verdict.get("NeedsApproval")
    if needs:
        approved = gov.approve(needs["approval_id"])
        print(f"approved wipe? {approved}; pending now: {gov.pending()}")

    # out-of-scope is blocked
    off_scope = dict(scan, target="8.8.8.8")
    print("off-scope verdict:", gov.check(off_scope))

    # high-CVSS exploit is blocked by the deny_if_cvss_above(7.0) rule.
    # `cvss` may be a bare number or an object {"cvss_v31": ..., "epss": ..., "kev": ...}.
    exploit = {
        "name": "exploit",
        "target": "10.0.0.6",
        "capabilities": ["privilege_escalation"],
        "impact": "high",
        "destructive": False,
        "cvss": 9.5,
    }
    print("exploit verdict:", gov.check(exploit))

    # full audit trail
    print("audit json:")
    print(json.dumps(gov.audit_json(), indent=2))


if __name__ == "__main__":
    main()