Lab: Lethal Trifecta Policy Gate

Apply the Rule of Two to AI-agent tool calls so private data, untrusted content, and outbound actions cannot combine into an exfiltration path.

Overview

This repository-first lab implements a policy gate for AI-agent tool calls. It focuses on preventing the dangerous combination of private data access, exposure to untrusted instructions, and the ability to communicate externally.

For broader defensive context, see the Agent 365 Defender playbook. This related reading is separate from the policy-gate repository’s lab guide.

Review Status

Source reviewed July 10, 2026; lab-only. Eleven Python policy/HTTP tests, dependency resolution/imports, PowerShell syntax, JSON, and Bicep compilation passed. The review did not publish the Flex Consumption app, seed Cosmos DB, ingest through the Data Collection Rule, or run the live endpoint smoke test.

The reviewed policy now returns 403 BLOCK for unregistered tools by default and returns 503 for evaluation and session requests when a configured durable session store is unavailable. It no longer treats an unknown tool or fresh in-memory state as a safe fallback. In-memory state is used only when Cosmos DB is explicitly unconfigured for a local run.

The Function exposes five endpoints. /api/health is process liveness only and remains 200; /api/readiness reads Cosmos container metadata and returns 503 when configured durable storage is unavailable. An unconfigured local run reports ready with in_memory storage and durable: false rather than pretending to be durable.

Safety and Limits

  • The deployed HTTP endpoints are anonymous for lab simplicity, including the session-history endpoint. Use only synthetic identifiers and data, deploy in a disposable subscription, and delete the resource group after testing.
  • Session state uses non-transactional read/modify/write operations. Concurrent calls for one session can race; this is not production-ready enforcement.
  • The gate classifies declared tool names. It does not inspect arguments, destinations, response data, indirect exfiltration, or actual tool side effects.
  • Cosmos seed writes use signed REST upserts, and the seeding step exits nonzero if any expected row fails; a partial seed is not reported as successful.
  • Azure deployment creates Function, Cosmos DB, Storage, Key Vault, Application Insights, Log Analytics, and ingestion resources. The template limits scale, but public use can still generate charges.

Start Here

  1. Open the canonical GitHub repository.
  2. Run the local attack simulation and policy unit tests before considering the Azure path.
  3. Review the anonymous-endpoint and concurrency limits, then follow the README through allowed/blocked scenarios, live validation, and cleanup.

The examples are defensive and should be run with synthetic data only.