智能代理工作流

Prerequisites

• Docker (recommended) or Rust 1.82+

See the policy gate deny a tool — one command, no setup

A Cedar forbid blocks a privileged tool while a safe one passes. Copy-paste this against the published image (no clone, no build):

docker run --rm --entrypoint sh ghcr.io/thirdkeyai/symbi:latest -c '
mkdir -p /tmp/p && cat > /tmp/p/policy.cedar <<EOF
forbid(principal, action == Symbi::Action::"tool_call::list_agents",   resource);
permit(principal, action == Symbi::Action::"tool_call::system_health", resource);
EOF
echo "{\"tool_name\":\"list_agents\"}"   | symbi policy evaluate --stdin --policies /tmp/p --json
echo "{\"tool_name\":\"system_health\"}" | symbi policy evaluate --stdin --policies /tmp/p --json'

{"decision":"deny","reason":"deny policies matched: policy_0","tool":"list_agents", ...}
{"decision":"allow","reason":"allow policies matched: policy_1","tool":"system_health", ...}

That's the same Cedar gate the runtime wires into the live reasoning loop — exactly the denial shown in the demo above.

Install the CLI

```bash

Linux / macOS — installs the `symbi` binary to /usr/local/bin

curl -fsSL https://symbiont.dev/install.sh | bash symbi --help ```

The installer fetches the prebuilt release binary for your platform. Pin a version with bash -s -- --version v1.15.2 or change the target with --dir. Prefer Docker or building from source? Both are below.

Scaffold and run a project (Docker, ~60 seconds)

```bash

Generates symbiont.toml, agents/, policies/, docker-compose.yml, and

Other Docker recipes

```bash

Build from source

```bash cargo build --release ./target/release/symbi --help

Quick start

Example: untrusted tool blocked by policy

An agent attempts to call an unverified MCP tool. The runtime:

1. Checks SchemaPin verification status — tool signature is missing or invalid
2. Evaluates Cedar policy — forbid(action == Action::"tool_call") when { !resource.verified }
3. Blocks execution and logs the denial with full context
4. Optionally routes to an operator for manual approval

No code change required. The policy governs execution.

---

DSL example

agent secure_analyst(input: DataSet) -> Result {
    policy access_control {
        allow: read(input) if input.verified == true
        deny: send_email without approval
        audit: all_operations
    }

    with memory = "persistent", requires = "approval" {
        result = analyze(input);
        return result;
    }
}

See the DSL guide for the full grammar including metadata, schedule, webhook, and channel blocks.

File extension: Symbiont agent definitions use .symbi as their canonical extension (e.g. agents/assistant.symbi). The legacy .dsl extension continues to be parsed indefinitely for backward compatibility, but new projects scaffolded with symbi init and all examples in this repo use .symbi.

---

a .env with a freshly generated SYMBIONT_MASTER_KEY.

docker run --rm -v $(pwd):/workspace ghcr.io/thirdkeyai/symbi:latest \ init --profile assistant --no-interact --dir /workspace

2. Start the runtime. Reads .env automatically.

docker compose up ```

That's it — Runtime API on http://localhost:8080, HTTP Input on http://localhost:8081. Use symbi init --catalog list (or the Docker equivalent) to browse pre-built agents.

Open Agent Trust Stack (OATS) — reference implementation

Symbiont is the reference implementation of the Open Agent Trust Stack (OATS) — an open specification (CC BY 4.0) for securing AI agent execution through structural enforcement rather than post-hoc interception ("define what is permitted and make everything else structurally inexpressible"). The OATS spec is grounded in Symbiont's production operational experience and Symbiont's design tracks the OATS layers directly:

Symbiont conforms to OATS Extended (C1–C7 + E1–E8). The empirical comparison of structural-enforcement runtimes that informs the spec is Wanger 2026 / DOI 10.5281/zenodo.20043247.

---

SDKs

Official client SDKs for integrating with the Symbiont runtime from your application:

Production recommendation: The JS and Python SDKs are HTTP clients intended for application integration and prototyping. For production agent workloads, we recommend building directly on the Rust implementation to leverage Symbiont's full typestate-driven safety guarantees — capability authorization, policy enforcement, and lifecycle invariants enforced at compile time rather than runtime. Dynamic-language clients can only verify these properties after a request crosses the runtime boundary.

---