Antigravity Agent に書き込み権限を安全に渡す — Permission Boundary の本番設計

// src/permission-boundary/gateway.ts
import { classifyOperation, AgentOperation } from './tier';
import { previewSqlDiff, previewS3Diff } from './diff';
import { enqueueApproval, waitForDecision } from './approval';
import { writeAuditLog } from './audit';
 
export interface ExecutionResult {
  status: 'executed' | 'rejected' | 'expired';
  affectedRows?: number;
  diff?: string;
  approver?: string;
}
 
export async function executeWithBoundary(
  op: AgentOperation,
  executor: () => Promise<{ affectedRows: number }>,
): Promise<ExecutionResult> {
  const tier = classifyOperation(op.resource, op.action);
 
  // Step 1: ドライラン — 実際には書き込まず、影響範囲だけを取得
  const diff = await runDryRun(op);
  if (diff.affectedRows > 10_000) {
    // 10,000 行を超える更新は Tier に関わらずブロック
    await writeAuditLog({ ...op, status: 'blocked-large-impact', diff });
    throw new Error(`Blocked: ${diff.affectedRows} rows exceeds safety threshold`);
  }
 
  // Step 2: Tier 0/1 は即実行、Tier 2/3 は承認キューへ
  if (tier <= 1) {
    const result = await executor();
    await writeAuditLog({ ...op, status: 'executed', diff, ...result });
    return { status: 'executed', ...result, diff: diff.summary };
  }
 
  // Step 3: 承認キューへ投入
  const ticket = await enqueueApproval({
    operation: op,
    diff: diff.summary,
    requiresTwoFactor: tier === 3,
    expiresAt: Date.now() + 30 * 60_000,  // 30 分でタイムアウト
  });
 
  const decision = await waitForDecision(ticket.id);
  if (decision.status !== 'approved') {
    await writeAuditLog({ ...op, status: decision.status, ticketId: ticket.id });
    return { status: decision.status === 'expired' ? 'expired' : 'rejected' };
  }
 
  const result = await executor();
  await writeAuditLog({ ...op, status: 'executed', diff, ticketId: ticket.id, approver: decision.approver, ...result });
  return { status: 'executed', ...result, diff: diff.summary, approver: decision.approver };
}
 
async function runDryRun(op: AgentOperation): Promise<{ affectedRows: number; summary: string }> {
  if (op.resource.startsWith('db:')) {
    return previewSqlDiff(op);
  }
  if (op.resource.startsWith('s3:')) {
    return previewS3Diff(op);
  }
  throw new Error(`No dry-run handler for resource: ${op.resource}`);
}

# src/permission_boundary/preview.py
import psycopg2
from contextlib import contextmanager
 
@contextmanager
def dry_run_transaction(conn):
    """書き込みはせず、影響範囲だけを取得するためのコンテキスト."""
    try:
        with conn.cursor() as cur:
            cur.execute("BEGIN")
            yield cur
    finally:
        # 必ず ROLLBACK して書き込みを取り消す
        conn.rollback()
 
def preview_update(conn, sql: str, params: tuple) -> dict:
    """UPDATE 文のドライラン. 実際には書き込まない."""
    with dry_run_transaction(conn) as cur:
        # まず SELECT で Before のスナップショットを取る
        select_sql = sql.replace("UPDATE", "SELECT * FROM", 1).split("SET")[0]
        cur.execute(select_sql, params)
        before_rows = cur.fetchall()
 
        # 実行して affected を取得（ROLLBACK されるので副作用なし）
        cur.execute(sql, params)
        affected = cur.rowcount
 
        if affected > 10_000:
            raise ValueError(f"Refusing dry-run: {affected} rows is too large for preview")
 
        return {
            "affected_rows": affected,
            "before_sample": before_rows[:10],  # 先頭 10 行だけ承認画面に見せる
            "summary": f"{affected} rows would be updated",
        }

# policies/agent_boundary.rego
package agent.boundary
 
import future.keywords.if
import future.keywords.in
 
# デフォルトは拒否
default allow := false
 
# Tier 0/1 は常に許可
allow if {
    input.operation.tier <= 1
}
 
# Tier 2 は承認者がいて、かつ営業時間内
allow if {
    input.operation.tier == 2
    input.approval.approver != ""
    is_business_hours(input.now)
}
 
# Tier 3 は二要素承認 + 緊急チケット必須
allow if {
    input.operation.tier == 3
    input.approval.two_factor == true
    input.approval.incident_ticket != ""
}
 
is_business_hours(ts) if {
    hour := time.clock([ts, "Asia/Tokyo"])[0]
    hour >= 9
    hour < 21
}
 
# プロジェクトごとの上限を別途チェック
deny[msg] if {
    input.agent.project == "experiment"
    input.operation.tier >= 2
    msg := "experimental agents cannot perform Tier 2+ operations"
}

// src/permission-boundary/audit.ts
interface AuditEntry {
  ts: string;
  operationId: string;
  agentId: string;
  resource: string;
  action: string;
  tier: PermissionTier;
  status: 'executed' | 'rejected' | 'expired' | 'blocked-large-impact';
  diff: string;
  beforeSnapshot?: Record<string, unknown>[];
  reverseSql?: string;
  approver?: string;
  ticketId?: string;
  affectedRows?: number;
}
 
export async function writeAuditLog(entry: Partial<AuditEntry>): Promise<void> {
  // 監査ログは別 DB（書き込み専用ロール）に append-only で送る
  await auditDb.query(
    `INSERT INTO agent_audit_log
     (ts, operation_id, agent_id, resource, action, tier, status, diff,
      before_snapshot, reverse_sql, approver, ticket_id, affected_rows)
     VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13)`,
    [
      new Date().toISOString(),
      entry.operationId ?? crypto.randomUUID(),
      entry.agentId ?? 'unknown',
      entry.resource,
      entry.action,
      entry.tier,
      entry.status,
      entry.diff ?? '',
      JSON.stringify(entry.beforeSnapshot ?? []),
      entry.reverseSql ?? '',
      entry.approver ?? null,
      entry.ticketId ?? null,
      entry.affectedRows ?? null,
    ],
  );
}
 
// 逆操作 SQL を自動生成する
export function generateReverseSql(beforeSnapshot: Record<string, unknown>[], table: string): string {
  if (beforeSnapshot.length === 0) return '-- no rows affected';
  const cases: string[] = [];
  for (const row of beforeSnapshot) {
    const setClauses = Object.entries(row)
      .filter(([key]) => key !== 'id')
      .map(([key, value]) => `${key} = ${JSON.stringify(value)}`)
      .join(', ');
    cases.push(`UPDATE ${table} SET ${setClauses} WHERE id = ${JSON.stringify(row.id)};`);
  }
  return cases.join('\n');
}

import { createHash } from 'crypto';
 
function sqlHash(sql: string, params: unknown[]): string {
  return createHash('sha256').update(sql).update(JSON.stringify(params)).digest('hex');
}

deny[msg] if {
    count([a | a := input.recent_approvals[_]; a.approver == input.approval.approver]) >= 5
    msg := "different approver required after 5 consecutive approvals"
}

// tests/boundary-coverage.test.ts
import { readdirSync, readFileSync } from 'fs';
import { join } from 'path';
 
// SQL クライアントを直接呼んでいる箇所を静的に検出する
const FORBIDDEN_DIRECT_CALLS = [
  /\bpool\.query\(/,
  /\bclient\.query\(/,
  /\bknex\([^)]*\)\.(insert|update|delete)\(/,
];
 
function walkSource(dir: string): string[] {
  return readdirSync(dir, { withFileTypes: true }).flatMap((e) => {
    const p = join(dir, e.name);
    if (e.isDirectory()) return walkSource(p);
    return p.endsWith('.ts') ? [p] : [];
  });
}
 
test('no write path bypasses executeWithBoundary', () => {
  const violations: string[] = [];
  for (const file of walkSource('src')) {
    if (file.includes('permission-boundary/')) continue; // 境界の内側は除外
    const code = readFileSync(file, 'utf8');
    for (const pattern of FORBIDDEN_DIRECT_CALLS) {
      if (pattern.test(code)) violations.push(`${file}: ${pattern}`);
    }
  }
  expect(violations).toEqual([]);
});

# policies/agent_boundary_test.rego
package agent.boundary
 
test_tier2_denied_outside_business_hours if {
    not allow with input as {
        "operation": {"tier": 2},
        "approval": {"approver": "masaki"},
        "now": 1735700400  # 深夜帯のタイムスタンプ
    }
}
 
test_tier3_requires_two_factor if {
    not allow with input as {
        "operation": {"tier": 3},
        "approval": {"two_factor": false, "incident_ticket": "INC-1"}
    }
}

# 中央ポリシーで、エージェントごとの上限 Tier を宣言的に管理する
max_tier := {
    "content-writer": 1,   # 記事生成エージェントは隔離環境のみ
    "monitor":        0,    # 監視は読み取り専用
    "deployer":       2,    # デプロイ担当だけが本番書き込み可
}
 
deny[msg] if {
    limit := max_tier[input.agent.id]
    input.operation.tier > limit
    msg := sprintf("agent %q is capped at tier %d", [input.agent.id, limit])
}

// 直近 30 日の監査ログから、そのエージェントの信頼度を算出する
async function trustScore(agentId: string): Promise<number> {
  const rows = await auditDb.query(
    `SELECT status, COUNT(*) AS n FROM agent_audit_log
     WHERE agent_id = $1 AND ts > now() - interval '30 days'
     GROUP BY status`,
    [agentId],
  );
  const total = rows.reduce((s, r) => s + Number(r.n), 0);
  const incidents = rows
    .filter((r) => r.status.startsWith('blocked') || r.status === 'rejected')
    .reduce((s, r) => s + Number(r.n), 0);
  if (total < 50) return 0;              // 実績が浅いうちは昇格させない
  return 1 - incidents / total;          // 0〜1 のスコア
}