Guides / Company rules

Company rules

Decide centrally which registries, websites and AI tools are allowed. The rules are signed by your organisation, so editing them on a developer's laptop locks that laptop out rather than opening it up.

The problem

AI tools gain abilities by plugging into other software — one plugin reads your tickets, another writes to your repositories, another can delete things. Each arrives with all of its abilities switched on. kosa8 lets an administrator approve them one at a time, per team.

$ kosa8 policy keygen
public:  kQ+JPoaWWs9JC1Nic/sRli1nJOAgQFAmmm+xtD0oEeo=
private: F+XQvHHIRNl7921Jt8r1G5TnOYdhcqkBNubo/aPkm...

$ kosa8 mcp-policy init > policy.json

{
  "name": "example-corp",
  "default_scope": "engineering",
  "scopes": [
    {
      "name": "engineering",
      "servers": [
        { "server": "github",
          "allow_tools": ["list_*", "get_*", "search_*"],
          "deny_tools":  ["*_delete", "delete_*"] }
      ]
    }
  ]
}

$ kosa8 mcp-policy sign key.txt policy.json > signed.json
$ kosa8 policy trust kQ+JPoaWWs9JC1Nic/sRli1nJOAgQFAmmm+xtD0oEeo=
$ kosa8 mcp-policy install signed.json
installed MCP policy "example-corp" (2 scope(s))
  servers not listed in a scope are now denied

no trusted policy signer is pinned, so any key would be accepted here —
pin your org's public key first with `kosa8 policy trust <PUBLIC_KEY>`

What it does

$ kosa8 mcp-policy check github list_issues
allowed: github/list_issues for scope engineering
  allowed by rule allow_tools "list_*"

$ kosa8 mcp-policy check github delete_repo
DENIED: denied by rule deny_tools "delete_*"

$ kosa8 mcp-policy check randomvendor read
DENIED: MCP server "randomvendor" is not approved for scope "engineering";
  approved servers: docs, github — ask your admin to add it to the org policy

A tool that no rule mentions is denied. Approval has to be written down, not merely un-forbidden.

Tampering locks the door

If someone edits the installed policy to grant themselves a permission, the signature stops matching and kosa8 refuses everything — including what they were legitimately allowed to do a moment earlier.

$ kosa8 mcp-policy check github list_issues
DENIED: the installed MCP policy failed verification: signature does not
  match (tampered or wrong key); re-install a policy signed by your org

The record

$ kosa8 mcp-policy events        # every allow and deny
$ kosa8 audit ls                 # every state-changing action
$ kosa8 audit verify
audit chain intact: 982 entries verified
$ kosa8 audit export --format cef  # for your SIEM

Each entry is sealed with the one before it. Change an old entry and every later one stops matching, and kosa8 tells you which one broke.