Policy Engine

Browse and enforce .ags/policy.yml registries that bind engines to required files.

What you will learn

• policy_get
• policy_plan
• policy_enforce

Prerequisites

• Mount PluginHost and merge MCP tools

Surface

What this feature does

Policy Engine is the registry of governance policies and requiredFiles. Use it to discover which .ags/*.yml must exist before other enforces.

Configuration

Wire these surfaces first: .ags/policy.yml.. Treat them as the contract agents must not invent around.

schemaVersion: 1
enabled: true
requiredFiles: []
items: []
graphArtifact: docs/policy-map/latest.json

How to call it

Call these MCP tools through your AGS / tower-gov host — policy_get, policy_validate, policy_enforce, policy_plan.. Prefer scan/get before validate/diff, and enforce only when the change set is ready.

1. policy_get
2. policy_plan
3. Apply remediation
4. policy_enforce

{
  /* Example MCP call — fill args from schema_get / docs */
  "tool": "policy_get",
  "arguments": {}
}

What success looks like

policy_enforce ok

Policy matches live state

Common failure modes

Config enabled but requiredFiles missing

Enforce without validate

Plan ignored

Related reference

• Configuration
• Architecture