You're protected.
This week Aggrete checked 1,284 requests from your team's AI assistants and prevented 12 that would have crossed a line. 6 protection packs are on, covering 214 people across Drive, Slack, HR and finance. Nothing needs you.
Trends
Last 30 daysNeeds your attention
Turn on what you need to protect.
Each pack is a set of rules written for you. Switch one on and the proxy enforces it immediately, across every assistant. No policy to write.
Advanced · what a pack is
A pack is a named set of rules incoc.yaml, drawn from real regulation and incidents. Toggling one writes pack_state.json and the proxy reloads; enforcement is deterministic, no model in the path. Each card above shows its rule count and pack id. The rules use the engine types:CSV for spreadsheets, JSON for your SIEM, an evidence pack (summary, tamper-evident chains and policy versions) for auditors, or print to PDF for leadership.
Turn a policy document into rules.
Drop an employee handbook, code of conduct or any policy document (PDF, DOCX, Markdown, any language). Aggrete drafts rules you can edit, preview against your real history, and publish. Nothing is enforced until you publish.
Advanced · rule types
Drafted rules use the engine's enforce types:coc.yaml is exactly what the proxy enforces.Connectors
Put a system behind the proxy from here. Add a connector, store its token (encrypted, never shown again), test the connection, and enable it. Reads are fenced to a boundary and governed by your packs; a write is governed as egress.
Add a connector
Advanced · under the hood
Each connector is an MCP server the proxy launches over stdio. Reads become<type>__search_<boundary> and read_ tools; a write is named with a write verb so the proxy governs it as egress. Secrets are encrypted at rest with Fernet and injected only into the connector process. Wire it in proxy.config.yaml under upstreams: and map its tools to a policy domain under domains:.| When | Person | Tool | Asked for | Decision | Rule | Hash |
|---|
Advanced · tamper evidence
Both logs are hash-chained: each row stores the prior row's SHA-256 and its own. Verify the decision log withaggrete-audit audit.jsonl and the admin log with the Verify button above. CSV/JSON export carries ts, user, tool, domain, stage, decision, rule, write, hash for your SIEM.Alerts
Notify a webhook when a threshold trips. A Slack incoming-webhook URL works directly. The highest-value trigger is a refusal spike.
Add an alert
Advanced · channels
Metrics evaluate over the current day:ALERT_SMTP_HOST/PORT/USER/PASS/FROM. A Slack incoming-webhook works as a plain webhook.Exceptions
Request a time-boxed exception to a rule. An approver who is not the requester decides it; approved exceptions auto-expire. Break-glass grants immediately for an emergency and is fully logged.
Request an exception
Advanced · segregation of duties
The requester can never approve their own exception (enforced per row). Approved exceptions are time-boxed and auto-expire; break-glass grants immediately but is logged asexception.break_glass in the admin action chain. Only Approver and Owner can decide.API tokens
Named, scoped tokens for automation. A token carries a role and is shown once at creation. Use it as a Bearer token on the API described below.
Create a token
Advanced · scopes
A token is a non-human principal carrying one role, checked by the same permission matrix as a user. Only the SHA-256 hash is stored; the value is shown once. Revoke instantly withDELETE /api/tokens/{id}. Prefer a narrow role (Auditor for read-only pipelines).API reference
openapi.jsonUsers & roles
Add people, set a password, and assign a role to restrict what they can see and do. When any user has a password (or you set AGGRETE_CONSOLE_AUTH=1), the console requires sign-in.
Add a user
Advanced · how passwords are stored
Passwords are hashed with PBKDF2-SHA256 (200k iterations, per-user salt); only the hash is stored inusers.json, never the password. Every request re-checks the role against the permission matrix. Seed the first owner with AGGRETE_CONSOLE_ADMIN=email:password, or require sign-in even before a password with AGGRETE_CONSOLE_AUTH=1.SSO & social login
Let people sign in with your company identity provider or a social account, and map their groups to console roles. Configure Google, Microsoft, GitHub, or any OIDC provider.
Connector integrity
Every upstream tool is fingerprinted the first time the proxy sees it. A later change to its description or schema (a rug pull), or a description carrying hidden instructions (poisoning), is flagged here. Re-trust a change to accept the new definition.
Advanced · how re-trust works
Fingerprints live in the proxy's pins file. Re-trusting drops a tool's pin, so the proxy re-pins its current definition on its next reconnect. This is separate from the audit chain integrity shown on the Audit page.Policy simulator
Try a sequence of data-domain accesses against the current policy and see what the proxy would decide, without touching any system. This runs the same engine the proxy runs.
Advanced · what this checks
The simulator replays your steps throughpre_call then post_call on a throwaway state, exactly as the proxy would, and stops at the first refusal. It answers "would this be allowed?" without fetching anything. Entity-overlap rules assume the steps concern the same people.