Builder Track

The rest of this wiki tells you what to govern, what to control and what to test. This section tells you how to build a first tool-using agent so that it passes those tests. It is short on purpose, and the code runs.

Audience: AI product developers, application security engineers and platform engineers who are building or reviewing their first agent.

Where to start

Secure Your First Agent: Ten Controls With Code takes you through ten controls in build order. Each has the control it implements, the risk it addresses, a short explanation, and working configuration or code. It ends with the wiki test cases you should run against your own build.

Agent Architecture Patterns is the design layer behind those controls: the lethal trifecta and the Agents Rule of Two, six patterns that contain prompt injection, identity standards for agents and MCP, tracing, and an architect's review checklist.

Privacy Duties in Code turns the duties of India's DPDP Act into code: consent per purpose and notice version, access, correction, erasure, grievance and nomination, retention with advance notice, children's data, and logs without personal data.

Developer Pipeline Checks runs the same checks in three places (git hooks, a coding agent's hook and CI): secrets, personal data written to logs, and a trailer that records whether an assistant or agent made each change.

Builder Toolkit brings the wiki into the developer's loop whichever assistant, editor, operating system or CI service you use: a checker for AI-specific risks in code and agent configuration (with SARIF output), a read-only MCP server that any MCP client can use to look up controls, risks and test cases, an export that turns the agent's audit log into rows for the audit and test templates, and one set of rules written as the instruction file of each coding assistant.

If you are...	Start with	Then use
Building a tool-using agent	Secure Your First Agent	AI System Inventory to register it, Test Case Tracker to record the tests
Designing or reviewing an agent architecture	Agent Architecture Patterns	AI Use-Case Risk Triage
Handling personal data	Privacy Duties in Code	AI Impact Assessment
Setting up a repository or CI for AI-assisted work	Developer Pipeline Checks and the Builder Toolkit	Audit and Evidence Checklist for the results
Wiring the wiki into an assistant, agent or GRC tool	Builder Toolkit	The CSV data files

The code

Everything is in the code/ folder, uses only the Python standard library, and has tests that run in CI.

File	What it is
`guard.py`	The enforcement layer: identity, scoped tokens, tool allow-list and pinning, argument validation, approval gate, rate limits, kill switch, audit log
`policy.json` and `tool_definitions.json`	The agent registry, tool rules and reviewed tool definitions the guard reads
`pin_definitions.py`	Writes the hash of each reviewed tool definition into the policy
`sandbox.py` and `winjob.py`	Runs generated code with process limits (a Job Object on Windows) and, where the kernel allows, no network
`egress_proxy.py`	An allow-list forward proxy that checks hosts and resolved addresses
`docker-sandbox.sh`, `docker-sandbox.ps1` and `k8s-agent-pod.yaml`	Container and Kubernetes settings for the real isolation boundary
`agent_demo.py`	A hijacked agent, played end to end with a scripted stand-in for the model
`privacy.py` and `privacy_map.json`	Consent ledger, rights desk, retention runner, children's gate and redacting logger, driven by one data map
`pipeline_checks.py`	Secret, personal-data-in-log and AI-Assistance trailer checks for git hooks, a coding agent's hook and CI
`aiwiki_check.py` and `ai_rules.json`	Checks code and agent configuration for AI-specific risks, with text, JSON or SARIF output
`mcp_server.py`	A read-only MCP server with wiki look-ups and the checks, for any MCP client
`wiki_data.py`	Offline look-ups and search over the wiki's CSV data files
`evidence_export.py`	Turns the guard's audit log and checker results into rows for the audit and test templates
`gen_instructions.py` and `agent_instructions.txt`	Writes one set of rules as each coding assistant's instruction file
`ci/`	GitHub Actions, GitLab CI and pre-commit examples
`test_*.py`	Tests for all of the above, including a check that the pages' code excerpts match the files. The Builder Track tests workflow runs them on Python 3.10 and 3.13 for every change to this section, on Linux, macOS and Windows

None of the code calls a model provider's API or depends on one assistant: the agent demo uses a scripted stand-in for the model, and the checks run from a terminal, git hooks, CI or any assistant that can run a command or call an MCP tool. All of it runs on Linux, macOS and Windows. Where a platform cannot do something, the code says so: on Windows, sandbox.py uses a Job Object and has no file-size limit, and only Linux can remove the network from the sandboxed process.

How this fits the rest of the wiki

The ten controls are control objectives from the Control Library. Their evidence and audit tests are there. The ten controls table names the register risks each one treats.
The Agentic AI Security and Tool Governance standard says what must be in place. This section shows one way to build it.
The Test Case Library is how you prove it, and the Payload Kit uses this section's guard as one of its stand-in applications.
The Templates are where the results go, and the CSV data files are the same controls, risks and test cases in a form your tools and the Builder Toolkit can read.
The OWASP Top 10 Crosswalk and OWASP MCP Top 10 Crosswalk map the OWASP risks the ten controls address.
The AI Coding Assistant and Coding Agent Security Standard and the NIST SSDF Crosswalk put the pipeline checks in context.

Evidence you can hand over

What a builder produces in this section, and where a risk owner or auditor records it.

What you produce	Where it goes	Control it evidences
The agent's entry in `policy.json`: owner, tools, scopes and limits	A row in the AI System Inventory (Technical Owner, Can Take Actions in Other Systems, Tools, APIs or Agents It Can Call, Kill Switch Test Date)	AI-CTRL-006, AI-CTRL-011
The guard's hash-chained audit log	Rows from `evidence_export.py` in the Audit and Evidence Checklist	AI-CTRL-008 and the control behind each recorded decision
Results of the wiki test cases you ran against your build	The Test Case Tracker	AI-CTRL-034
CI runs of the pipeline checks and the AI checker (SARIF)	Evidence Ref in the Audit and Evidence Checklist	AI-CTRL-004, AI-CTRL-033
The privacy data map and consent records	The AI Impact Assessment	AI-CTRL-013
A record of any incident or kill-switch use	The AI Incident Report	AI-CTRL-035

Evidence shows that something happened, not that a control works. The reviewer still decides the result.

Pages in This Section

Secure Your First Agent: Ten Controls With CodeTen controls for a first tool-using AI agent, in build order, with working configuration and code for tool allow-lists, argument validation, scoped short-lived credentials, sandboxing, egress limits and approval gates. Agent Architecture PatternsDesign-level defences for agents: the lethal trifecta and the Agents Rule of Two, six design patterns that contain prompt injection, identity and authorization standards for agents and MCP, tracing, and an architect's review checklist. Privacy Duties in Code: Consent, Rights, Retention and Children's DataWorking, tested code for the privacy duties an AI product carries under India's DPDP Act: consent per purpose and notice version, access, correction, erasure, grievance and nomination, retention with advance notice, children's data, and log redaction with keyed pseudonyms. Developer Pipeline Checks for AI-Assisted CodeWorking, tested checks that run in three places (git hooks on the developer's machine, a coding agent's pre-write hook, and CI): secrets, personal data written to logs, and a trailer that records how each change was made. Builder Toolkit: Checks, MCP Server and Agent InstructionsVendor-neutral tools that bring the wiki into the developer's loop: an AI-specific code and configuration checker with SARIF output, a read-only MCP server for any MCP client, offline look-ups of controls, risks and test cases, an evidence export for the wiki's templates, and one set of instructions for every coding assistant.