Policy-aware action router + authority governance layer for AI agents
Nexus
A private-runtime authorization gateway that sits between AI agents and the actions they want to take: identity and vault-backed credentials, a governed lexicon/compile layer, an MCP adapter, and a 10-scenario policy test suite covering approval workflows, delegation limits, replay-attack detection, and default-deny access control.
policy-engineiamrbacmcpagent-governancetypescript
Problem
- Once an AI agent can take real actions instead of only generating text, the actual engineering problem stops being "can the model do this" and becomes "who is allowed to authorize this, under what identity, and what happens when that authorization is replayed, forged, or exceeded."
- Most agent stacks answer this with an API key and a prompt. Nexus exists because that is not an authorization system, it is a hope.
Architecture
- Nexus is a policy-aware action router: every action an agent wants to take passes through an authority-governance layer before it executes, not after.
- Identity and credential handling are isolated into their own package (packages/identity-ref) with a dedicated vault connector (packages/connectors/vault), so credentials are never a first-class citizen of the routing or orchestration logic.
- A model/data-boundary and egress-governance layer (packages/vanguard) sits alongside the router: what a model is allowed to see and send outward is a separate, explicit concern from what actions it is allowed to trigger.
- A governed lexicon and compile layer (config/lexicon, config/compile, packages/contracts) turns declared intents into a fixed, checkable vocabulary instead of free-form strings.
- An MCP (Model Context Protocol) adapter (packages/adapters/mcp) and a shipped nexus-mcp-proxy binary integrate the router with the current agent-tooling ecosystem rather than a bespoke one-off interface.
Policy and Access Control
- Authorization is enforced through key-based roles for admins and approvers (keys/admins, keys/approvers), not a single shared secret.
- The system is tested against ten explicit adversarial and edge-case scenarios: default-deny, allow-read, allow-create, approval-approved, approval-denied, approval-timeout, replay-detected, policy-unsigned, broad-token-bypass, and delegation-exceeded.
- That list is the actual acceptance criteria for an authority-governance layer: it has to fail closed by default, and it has to be provably resistant to replay and delegation abuse, not just documented against them.
Engineering Discipline
- The rate limiter is explicitly documented as a single-process, in-memory implementation with no cross-instance guarantee, with a SQLite-backed replacement deferred to post-POC rather than silently overstated.
- A clean clone is expected to pass install, build, lint, typecheck, test, and a dedicated ci:gate before either CLI entry point (nexus, nexus-mcp-proxy) is considered provably working.
Result
- Nexus is the authority layer underneath the rest of this portfolio's AI-agent work: a real policy engine, a real identity/credential boundary, and a real MCP integration, not a wrapper around someone else's SaaS agent framework.