agentcli/examples/cloud-workload.json at main · amittell/agentcli · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
{
  "version": "0.2",
  "identity_profiles": [
    {
      "id": "azure-agent",
      "provider": "azure-managed-identity",
      "subject": {
        "kind": "workload",
        "principal": "agent://azure/trading-bot",
        "display_name": "Trading Data Agent"
      },
      "auth": {
        "mode": "service",
        "required": true,
        "provider_config": {
          "resource": "https://management.azure.com/"
        }
      },
      "trust": {
        "level": "supervised",
        "constraints": {
          "max_autonomy": "supervised",
          "escalation": "fail"
        }
      },
      "presentation": {
        "bindings": [
          {
            "source": "credentials.access_token.value",
            "target": { "kind": "env", "name": "AZURE_TOKEN" },
            "required": true,
            "redact": true
          }
        ],
        "handoff": "none",
        "cleanup": "always"
      }
    }
  ],
  "evidence_profiles": [
    {
      "id": "ssh-evidence",
      "provider": "ssh",
      "payload": {
        "bind": ["execution_id", "declared_identity", "resolved_identity", "contract", "command", "result"],
        "context": {
          "model_version": true,
          "policy_version": true
        },
        "format": "canonical-json"
      },
      "verify": { "required": false }
    }
  ],
  "workflows": [
    {
      "id": "trading-data",
      "name": "Trading Data Pipeline",
      "identity": { "ref": "azure-agent" },
      "contract": {
        "sandbox": "strict",
        "network": "restricted",
        "allowed_paths": ["/data/trading"],
        "audit": "always",
        "required_trust_level": "supervised",
        "trust_enforcement": "strict"
      },
      "tasks": [
        {
          "id": "fetch-prices",
          "name": "Fetch Market Prices",
          "shell": {
            "program": "echo",
            "args": ["fetching prices"]
          },
          "target": { "session_target": "shell" },
          "evidence": { "ref": "ssh-evidence" },
          "schedule": { "cron": "*/5 * * * *" }
        }
      ]
    }
  ]
}