bastionguard 0.1.0

Quickstart · Framework integrations · Dashboard · Live demo · Why

Why

AI agents are shipping fast and getting real permissions — deleting records, sending emails, moving money, running shell commands. Most teams have zero enforcement between "the model decided to call a tool" and "the tool ran." bastion sits in that gap:

 agent decides to call a tool
          │
          ▼
    ┌──────────┐      allow    ──▶  tool runs
    │ bastion  │      block    ──▶  denied, agent sees why
    │  policy  │      approve  ──▶  human reviews (Slack / dashboard / console)
    └──────────┘
          │
          ▼
   every decision logged

Not another prompt-injection classifier — enforcement on what agents are actually allowed to do.

What you get

Quickstart

pip install bastionguard — the PyPI distribution is named bastionguard (plain bastion was already taken — an old Python 2 stdlib module, of all things). The import name is unaffected: still import bastion.

from bastion import PolicyEngine, Rule, Action, guard
from bastion.policy import arg_exceeds

policy = PolicyEngine()
policy.add_rule(Rule(tool_pattern="delete_*", action=Action.BLOCK, reason="irreversible"))
policy.add_rule(Rule(
    tool_pattern="transfer_funds",
    action=Action.APPROVE,
    condition=arg_exceeds("amount", 500),
    reason="large transfers need a human",
))

def transfer_funds(account: str, amount: float) -> str:
    return f"sent ${amount} to {account}"

guarded = guard(transfer_funds, policy=policy)
guarded(account="acct_1", amount=600)  # prompts for approval in the terminal

python examples/basic_example.py   # runs the full demo above

Rules can also live in YAML instead of hand-written Python:

from bastion import load_policy_from_yaml
policy = load_policy_from_yaml("policy.yaml")

See examples/policy.yaml for the schema.

Framework integrations

from bastion.integrations.langgraph import guarded_tool_node

tool_node = guarded_tool_node([my_tool_a, my_tool_b], policy=policy)
# use tool_node exactly where you'd use langgraph.prebuilt.ToolNode(tools)

pip install "bastionguard[langgraph]"

from bastion.integrations.openai_agents import guarded_tools

agent = Agent(name="...", tools=guarded_tools([my_tool_a, my_tool_b], policy=policy))

pip install "bastionguard[openai-agents]"

from claude_agent_sdk import ClaudeAgentOptions
from bastion.integrations.claude_agent_sdk import guarded_can_use_tool

options = ClaudeAgentOptions(can_use_tool=guarded_can_use_tool(policy=policy))

pip install "bastionguard[claude-agent-sdk]"

PII / secrets scanning

from bastion import Rule, Action, contains_pii, enforce_text_policy

policy.add_rule(Rule(
    tool_pattern="*",
    action=Action.BLOCK,
    condition=contains_pii(["ssn_us", "credit_card"]),
    reason="tool call args contain PII/secrets",
))

# directly on an LLM response, outside the tool-call path:
enforce_text_policy(llm_output, categories=["email"], on_detect="redact")

Also available as a YAML condition type (type: contains_pii). See examples/pii_scanning_example.py.

Slack approval

from bastion.integrations.slack import SlackApprovalHandler

approval_handler = SlackApprovalHandler(
    token="xoxb-...",       # needs chat:write + reactions:read scopes
    channel="#agent-approvals",
)

Posts a message and polls for a ✅/❌ reaction — no webhook server required. Fails closed (denies) if nobody responds within timeout seconds.

Dashboard

A real Next.js app (dashboard/) — audit log, approval queue, and a policy editor, all wired to the SDK over HTTP:

from bastion import AuditLogger, guard
from bastion.integrations.dashboard import (
    DashboardApprovalHandler,
    dashboard_audit_sink,
    load_policy_from_dashboard,
)

api_key = "..."  # must match DASHBOARD_API_KEY in the dashboard's env
policy = load_policy_from_dashboard("http://localhost:3000", api_key)
audit = AuditLogger(sink=dashboard_audit_sink("http://localhost:3000", api_key))
approval_handler = DashboardApprovalHandler("http://localhost:3000", api_key)

The dashboard UI is behind a separate session login (not this API key) — see dashboard/README.md for the full auth model and self-hosting setup.

Install

pip install bastionguard
# with a framework integration:
pip install "bastionguard[langgraph]"   # or [openai-agents] / [claude-agent-sdk]
# with Slack approval:
pip install "bastionguard[slack]"

For local development (editable install, running the test suite), see CONTRIBUTING.md.

Tests

ruff check . && mypy src && pytest -q

Framework integration tests run against the real installed package for each framework, never a mock — see AGENTS.md for why that's a hard rule here.

Project status

Pre-1.0. Core SDK, all three framework integrations, and the dashboard are built and tested — see CHANGELOG.md for what's shipped and PLAN.md for what's next. Not yet on PyPI; install from source for now (see CONTRIBUTING.md).

Contributing

Issues and PRs welcome — see CONTRIBUTING.md. Found a security issue? See SECURITY.md instead of opening a public issue for it.

License

Apache 2.0