l-agence/Agence Guard

Gate AI agent commands through the Agence MLS policy engine — every command classified before it runs.

Trust Signals

Scorecard Score: not yet scored
Maintenance Recency: Activelast commit May 11, 2026
License: None

Pinned Snippet

workflow.ymlSHA-pinned

uses: l-agence/agence@47dda877e0638b1212ef124e11df69db46464c9a # v1.0.0

tags can be moved; commit SHAs can't. why a SHA?

Inputs

name	description	required	default
command	Shell command to classify (e.g. "git push origin main")	yes	—
policy	Path to AIPOLICY.yaml, relative to GITHUB_WORKSPACE. Defaults to the bundled Agence policy (codex/AIPOLICY.yaml).	no	""
agent	Agent name for MLS capability checks. Must match an entry in codex/agents/registry.json. The bundled "ci" identity is intended for GitHub Actions workflows.	no	ci
fail_on_block	Exit 1 when the command is T3-blocked (deny). Default: true.	no	true
fail_on_escalate	Exit 1 when the command requires human escalation (T2). Default: false.	no	false

Outputs

name	description
tier	Trust tier: T0 (auto-exec) · T1 (flag) · T2 (escalate) · T3 (deny)
action	Policy action: allow · flag · escalate · deny
reason	Human-readable reason for the guard decision
rule	Policy rule that matched (e.g. whitelist.git_cli, blacklist.linux_shell)