Use pre-built policy tiers

Agent Guard publishes four pre-built policy tiers on the public Jozu Hub. Each tier is an OCI artifact containing a bundle of ToolPolicies tuned for a different risk tolerance. Pick the one that matches your situation, or compose two tiers to combine their effects.

The four tiers

Tier	Ref	What it does
Strict	jozu.ml/jozu/agentguard-policies:vm-strict	Localhost-only network, no netcat, no ssh/scp/rsync. All git push and package publishing blocked. Credential access and reads blocked. Host init, kernel surfaces and shell startup files protected. apt-get install requires confirmation.
Standard	jozu.ml/jozu/agentguard-policies:vm-standard	Domain-allowlisted network. Force push and npm publish blocked. Credential access, credential reads and environment-variable exfiltration blocked. Host init and kernel surfaces protected. Destructive commands (rm -rf, DROP TABLE, TRUNCATE) require confirmation.
Permissive	jozu.ml/jozu/agentguard-policies:vm-permissive	Open network, with credential and environment-variable exfiltration blocked. Force push blocked on main/master only. Host init and kernel surfaces protected.
Supply Chain	jozu.ml/jozu/agentguard-policies:vm-supply-chain	Restricts package managers to named packages from default indexes, blocks npm publish, and blocks curl and git clone carrying embedded credentials. Designed to layer on top of any tier.

Each summary lists what the tier is mainly for, not its full rule set. Every tier is built from ToolPolicies; agentguard policy list shows what you have loaded, and the bundle itself is the authoritative list.

How to install a tier

agentguard policy add jozu.ml/jozu/agentguard-policies:vm-standard

Confirm it loaded:

agentguard policy list

The policy is now active for every agentguard run until you remove it.

Always include the registry hostname in the ref. The public Hub uses jozu.ml/. If you run a private Hub, use your Hub's domain:

agentguard policy add hub.acme.com/jozu/agentguard-policies:vm-standard

If you leave the hostname off (a bare jozu/agentguard-policies:vm-standard), Agent Guard resolves it against the local registry, which is only what you want when testing locally.

The registry host is recorded in ~/.agentguard/config.json and reused for every subsequent sync.

Picking a tier

Use this decision table.

• You are evaluating Agent Guard for the first time and want to see policy in action: Standard. It blocks the things most teams care about (force push, destructive operations) without locking the agent down so hard that you cannot get useful work done.
• You are running an agent in a sensitive context (production data, regulated workload, untrusted code review): Strict. The localhost-only network is the strongest control and forces every external call through the audit log if you want to allow it.
• You are running an agent against your own personal projects and want minimal friction: Permissive. Only the things that are almost always wrong (force push to main, plaintext credential exfiltration) are blocked.
• You want supply chain protection regardless of which other tier you use: Supply Chain. Layer it on any tier.

Composing tiers

The Supply Chain tier is designed to overlay another tier. Add both:

agentguard policy add jozu.ml/jozu/agentguard-policies:vm-standard
agentguard policy add jozu.ml/jozu/agentguard-policies:vm-supply-chain

Both bundles load and both are evaluated on every tool call.

Ordering matters once more than one bundle is loaded. Policies are evaluated in alphabetical order by metadata.name, and Elicit and Redact short-circuit: once one fires, nothing sorting after it is evaluated, including policies from a different bundle. An Enforce rule that sorts after an Elicit rule from another bundle never runs. Enforce itself does not short-circuit, so denials from policies that do run are all collected. See Evaluation and ordering before composing a tier with policies of your own.

You can also mix in your own policies. Local files in ~/.agentguard/policies/global/ are evaluated alongside any tier you have added. For what a full set covering all three kinds looks like, see A layered policy, worked through.

Handling supply chain risks

A package pulled by npm or pip is not an OCI artifact Agent Guard admits, so there is nothing for an ArtifactPolicy to evaluate. The control has to sit where the install actually happens: the shell. ArtifactPolicy covers the other half of supply chain risk, the MCP servers and skills that become part of the agent. See Picking the right kind for how the two divide.

One consequence to plan around: rules keyed on pip do not catch python -m pip, pipx, or uv pip. If your projects use those, add them.

Pinning to a specific version

Tier refs include a tag (:vm-standard, :vm-strict). The same tag can be updated by Jozu when new rules are added. To pin to a specific snapshot, use the digest form:

agentguard policy add jozu.ml/jozu/agentguard-policies@sha256:abc123...

Pinning is most useful in CI or shared deployments where you want every run to see exactly the same policy.

Removing a tier

agentguard policy remove jozu.ml/jozu/agentguard-policies:vm-standard

See Manage policies for the full management flow.