Rampart

---

AI agents can edit files, run commands, call APIs, and ship code at machine speed. Their permission systems usually ask a different question: **can this tool run?**

Rampart asks: **should this action run?**

It sits at supported hooks, plugins, proxies, and process boundaries; evaluates the action against local policy; and returns `allow`, `ask`, or `deny` before the host executes it. Decisions are visible, approvals stay human-owned, and the result becomes part of a hash-chained audit trail.

Agent proposes an action
          │
          ▼
   ┌─────────────┐
   │   Rampart   │  policy · approval · audit
   └──────┬──────┘
          │
      allow / ask / deny
          │
          ▼
Host executes — or does not

Rampart is a security boundary, **not a sandbox**. It sees actions exposed by the configured integration; it does not see arbitrary syscalls or network traffic inside a process you already allowed. Start with the [threat model](docs/THREAT-MODEL.md) when deciding where to rely on it.

Install

brew install peg/tap/rampart

rampart protect