Autonomous Defense Policy Agent

A working demo of a policy-governed autonomous security system — the companion code for the blog post Autonomous Defense Without Autonomous Risk.

The core idea:

Autonomous defense should not mean "let an AI agent freely fix production." It means a policy-governed system that detects risk, reasons about impact, proposes remediation, executes only low-risk actions, and escalates high-risk changes with full auditability.

---

Demo output

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
  Autonomous Defense Policy Agent
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

[finding-001]  public_s3_bucket
  asset:        dev-data-bucket  (dev)
  risk:         5.83/10  MEDIUM
  plan:         block_public_s3_access
  policy:       ✓  ALLOW — non-prod action with high confidence and rollback
  execution:    ✓  success
  verification: ✓  verified

[finding-002]  public_s3_bucket
  asset:        payments-api-prod-data  (prod)
  risk:         9.5/10  CRITICAL
  plan:         block_public_s3_access
  policy:       ⚠  REQUIRES APPROVAL — production environment
  queued:       HR-xxxx

[finding-005]  network_policy_change
  asset:        prod-vpc-firewall  (prod)
  risk:         7.42/10  HIGH
  policy:       ✗  DENY — blast_radius is high

  findings processed:   7
  auto-remediated:      4
  queued for approval:  2
  denied:               1

---

Architecture

Security Signals
      │
      ▼
Normalization Layer
      │
      ▼
Risk Scoring Engine  ◄──  Asset / Knowledge Graph
      │
      ▼
Defender Agent Planner
      │
      ▼
Policy Decision Point
  ├── ALLOW  ──►  Execution Broker  ──►  Verifier  ──►  Audit
  ├── APPROVE ──►  Human Review Queue  ──►  Audit
  └── DENY   ──►  Audit (no action)

Full Mermaid diagrams: diagrams/architecture.md

---

Components

Module	File	Responsibility
Risk scorer	risk/scorer.py	Weighted multi-dimensional risk score (0–10)
Agent planner	agent/planner.py	Produces a remediation plan per finding
Policy engine	policy/engine.py	allow / requires_approval / deny
Rego policy	policy/remediation.rego	OPA-compatible canonical policy definition
Execution broker	broker/executor.py	Simulates narrowly-scoped, short-lived execution
Verifier	verifier/verify.py	Confirms the action had the intended effect
Audit logger	audit/logger.py	Append-only record of every decision and action

---

Quick start

git clone https://github.com/woxff/autonomous-defense-policy-agent
cd autonomous-defense-policy-agent
python3 main.py

No dependencies required for the default rule-based planner.

Enable LLM planning with Claude

pip install anthropic
export ANTHROPIC_API_KEY=sk-ant-...
python3 main.py

When ANTHROPIC_API_KEY is set, the planner switches to Claude (claude-haiku-4-5) with prompt caching. The policy engine, broker, and verifier are identical in both modes — the LLM only affects the planning step.

---

Adding your own findings

Edit examples/findings.json. Each finding requires:

{
  "id": "finding-008",
  "asset_id": "asset-001",
  "asset": "my-service",
  "finding_type": "open_security_group",
  "severity": "high",
  "owner": "platform-team",
  "environment": "staging",
  "data_classification": "internal",
  "internet_exposed": true,
  "exploitability": "high",
  "blast_radius": "low",
  "description": "Security group allows 0.0.0.0/0 on port 22",
  "secret_scope": ""
}

Supported finding_type values: public_s3_bucket · overly_broad_iam · missing_security_label · exposed_secret · container_runs_as_root · open_security_group · network_policy_change

---

Policy rules (summary)

Condition	Decision
blast_radius == high	DENY
action_type == delete_resource	DENY
add_security_label, high confidence	ALLOW
open_change_ticket, high confidence	ALLOW
Non-prod S3 block, high confidence, rollback available	ALLOW
Single-service secret rotation, owner notified	ALLOW
Non-prod security context, rollback available	ALLOW
Any of the above in prod	REQUIRES APPROVAL
Anything else	REQUIRES APPROVAL

The canonical policy is in policy/remediation.rego (OPA/Rego). policy/engine.py is the Python implementation used by the demo.

---

Audit log

Every run writes audit/audit_log.jsonl. Each record includes the event type, finding ID, action, decision, policy version, and timestamp. Example:

{"event": "policy.decision", "finding_id": "finding-001", "action": "block_public_s3_access", "decision": "allow", "reason": "non-prod public access block with high confidence and rollback", "policy_version": "2026-04-01", "environment": "dev", "blast_radius": "low", "timestamp": "2026-04-28T12:00:00+00:00"}
{"event": "broker.execution", "finding_id": "finding-001", "action": "block_public_s3_access", "success": true, "credential_scope": "s3:PutBucketPublicAccessBlock on specific bucket ARN", "dry_run": false, "timestamp": "2026-04-28T12:00:00+00:00"}
{"event": "verifier.result", "finding_id": "finding-001", "check": "S3 block-public-access flag is enabled on bucket", "passed": true, "rollback_required": false, "timestamp": "2026-04-28T12:00:00+00:00"}

---

Related

• Blog post: Autonomous Defense Without Autonomous Risk
• Policy reference: OWASP AI Agent Security Cheat Sheet
• IAM design companion: IAM Design for Multi-Tenant AI Platforms