Add agent_governance use-case example

[tomjwxf]

Summary

Adds a new use-case example at cedar-example-use-cases/agent_governance/ that shows Cedar as the policy layer for an AI agent host (Claude Code, Cursor, a custom MCP agent, etc.). The example uses the four canonical agent action verbs (exec, open, connect, request_tool) as the vocabulary for agent-host policy authoring.

Mirrors the structure of cedar-example-use-cases/github_example/:

• README.md — walkthrough of the use case, entities, actions
• policies.cedar — 5 policies covering common agent-governance patterns
• policies.cedarschema — Cedar schema for the example (self-contained)
• entities.json — 9 sample entities
• ALLOW/ — 3 test queries that should permit
• DENY/ — 4 test queries that should deny

What this demonstrates

Five policies exercise the main patterns:

1. allow-workspace-read — agents at ring 2+ can read files inside /workspace
2. allow-metadata-tool-ring-1 — ring 1+ agents can invoke read-only MCP tools (Read, Glob, Grep)
3. deny-cloud-metadata — forbid network connections to cloud instance metadata endpoints regardless of trust
4. deny-credential-files — forbid file reads in .ssh, .aws, .kube directories
5. require-trust-for-exec — exec gated on ring and trust_score

Cedar's forbid precedence is demonstrated: a request to open /workspace/.ssh/id_rsa is denied even though allow-workspace-read would permit it, because deny-credential-files takes precedence.

Why this matters

Agent governance is a fast-growing space where operators need portable policies across frameworks (Microsoft AGT, protect-mcp, sb-runtime, Signet, APS, nono). Using canonical verbs from a single shared schema makes operator policies portable. This example shows what that looks like in Cedar.

The full canonical schema and reference policy library live in the community-maintained VeritasActa/cedar-agent-schemas repository, created in response to the scope pattern established in Cedar RFCs #58 (standard library) and #69 (schema libraries).

Scope

Fully self-contained under cedar-example-use-cases/agent_governance/. No changes to any other directory. No new top-level files or folders.

Verification

• policies.cedar validates against policies.cedarschema
• ALLOW queries succeed against the policy set
• DENY queries are denied against the policy set
• Structure mirrors existing github_example/ convention

Related

• VeritasActa/cedar-agent-schemas — canonical community schema library for agent action verbs
• OWASP Agentic Top 10 — threat catalog these policies address
• Cedar RFC #58 and #69 — community-venue schema-library pattern