Pigeon: Agentlar uchun xavfsiz va cheklangan huquqlar tizimi

Pigeon — bu agentlar uchun xavfsiz va cheklangan huquqlar tizimi. U sub-agentlarga faqat kerakli huquqlarni berish imkonini beradi. Bu tizim agentlar uchun xavfsizlikni oshirish va huquqlarni boshqarishni osonlashtiradi.

Nima uchun bu muhim?

Bugungi kunda agentlar va avtomatik tizimlar keng tarqalgan. Ular turli vazifalarni bajarish uchun ishlatiladi. Ammo, bu tizimlarning xavfsizligi va huquqlarni boshqarish muammolari mavjud. Pigeon ushbu muammolarga yechim beradi.

git clone https://github.com/pigeonlabsHQ/pigeon.git
cd pigeon
pip install .

Pigeonning ishlash prinsipi

Pigeon agentlarga Pigeon Pass deb ataladigan cheklangan huquqlarni beradi. Bu Pass agentning qanday amallarni bajarishi mumkinligini belgilaydi. Misol uchun, agent faqat stajing muhitiga deploy qilish huquqiga ega bo'lishi mumkin, lekin production muhitiga deploy qilish huquqiga ega bo'lmaydi.

from pigeon import grant, verify

authority = grant(
    subject="agent:deployer",
    capabilities=["deploy"],
    resources=["environment:staging"],
)

allowed = verify(authority, action="deploy", resource="environment:staging")
assert allowed.allowed

denied = verify(authority, action="deploy", resource="environment:production")
assert not denied.allowed
assert denied.reason_code == "RESOURCE_NOT_ALLOWED"
print(denied.reason_code, denied.message, denied.details)

Pigeon Passni yaratish uchun grant funksiyasidan foydalaniladi. Bu funksiyaga agentning huquqlari, resurslari va cheklovlari beriladi. Keyin, bu Pass sub-agentlarga beriladi.

python examples/01_infrastructure.py
python demo/agent.py

Misol uchun:

from pigeon import delegate, grant, verify, DelegationError

parent = grant(
    subject="agent:orchestrator",
    capabilities=["deploy", "open_pr"],
    resources=["environment:staging", "repo:acme/api"],
    constraints={"max_deploys_per_hour": 3},
)

worker = delegate(
    parent,
    subject="agent:pr-bot",
    capabilities=["open_pr"],
    resources=["repo:acme/api"],
    constraints={"max_deploys_per_hour": 3},  # cannot drop a parent constraint
)

result = verify(worker, action="open_pr", resource="repo:acme/api")
assert result.allowed

denied = verify(worker, action="deploy", resource="environment:staging")
assert denied.reason_code == "CAPABILITY_NOT_GRANTED"

try:
    delegate(worker, "agent:rogue", ["open_pr", "deploy"], ["repo:acme/api"])
except DelegationError as exc:
    assert exc.reason_code == "PRIVILEGE_ESCALATION"

from pigeon import grant, verify

authority = grant(
    subject="agent:deployer",
    capabilities=["deploy"],
    resources=["environment:staging"],
)

allowed = verify(authority, action="deploy", resource="environment:staging")
assert allowed.allowed

denied = verify(authority, action="deploy", resource="environment:production")
assert not denied.allowed
assert denied.reason_code == "RESOURCE_NOT_ALLOWED"
print(denied.reason_code, denied.message, denied.details)

Pigeonning afzalliklari

• Xavfsizlikni oshirish: Pigeon agentlarga faqat kerakli huquqlarni beradi, bu xavfsizlikni oshiradi.
• Huquqlarni boshqarishni osonlashtirish: Pigeon huquqlarni boshqarishni osonlashtiradi, bu tizimlarni boshqarishni osonlashtiradi.
• Cheklangan huquqlar: Pigeon agentlarga faqat kerakli huquqlarni beradi, bu tizimlarning xavfsizligini oshiradi.

Pigeonning cheklovlari

Pigeon faqat huquqlarni boshqarish uchun mo'ljallangan. U platforma, siyosat dvigateli, identifikatsiya provayderi yoki kalitni saqlash tizimi emas. U faqat huquqlarni cheklash va xavfsizlikni oshirish uchun ishlatiladi.

from pigeon import grant
from pigeon.integrations.mcp import execute_tool, pass_for_tool

parent = grant(
    subject="agent:github",
    capabilities=["create_issue", "merge_pr"],
    resources=["mcp:github"],
)

tool_pass = pass_for_tool(parent, "create_issue", "mcp:github")

def create_issue(*, title, body):
    return {"created": True, "title": title}

ok = execute_tool(tool_pass, "create_issue", "mcp:github",
                  {"title": "bump deps", "body": "automated"}, create_issue)
assert ok["allowed"]

no = execute_tool(tool_pass, "merge_pr", "mcp:github",
                  {"title": "nope", "body": "nope"}, create_issue)
assert no["reason_code"] == "CAPABILITY_NOT_GRANTED"

Pigeonning cheklovlari quyidagilar:

pigeon keygen
pigeon inspect pass.json

• U faqat huquqlarni cheklash uchun ishlatiladi.
• U platforma, siyosat dvigateli, identifikatsiya provayderi yoki kalitni saqlash tizimi emas.
• U faqat huquqlarni cheklash va xavfsizlikni oshirish uchun ishlatiladi.

Yakun

Pigeon agentlar uchun xavfsiz va cheklangan huquqlar tizimi. U agentlarga faqat kerakli huquqlarni berish imkonini beradi, bu xavfsizlikni oshiradi va huquqlarni boshqarishni osonlashtiradi. Pigeonning afzalliklari va cheklovlarini bilish agentlar uchun xavfsizlikni oshirish va huquqlarni boshqarishni osonlashtirish uchun muhimdir.

Asl manba: github.com