Policy regression tests

Policy tests evaluate the same host, method, path, egress, and deny-precedence logic used by the Agent Proxy. They let you protect a reviewed credential capability in CI without loading secrets, starting an agent, or making a network request.

Embedded tests

Add cases directly to a repository-local profile with [[policy_tests]]:

[[policy_tests]]
name = "Read issue details"
secret = "GITHUB_TOKEN"
method = "GET"
host = "api.github.com"
path = "/repos/acme/widget/issues/42"
expect = "allow"

[[policy_tests]]
name = "Block repository deletion"
secret = "GITHUB_TOKEN"
method = "DELETE"
host = "api.github.com"
path = "/repos/acme/widget"
expect = "deny"

Run embedded tests with the selected profile:

stashbase agent policy test --profile github

Request bodies

For rules with request conditions, add the JSON body the request would send:

[[policy_tests]]
name = "Sending mail is refused"
secret = "MAIL_KEY"
method = "POST"
host = "api.mail.example"
path = "/v1/messages"
body = '{"send": true, "to": ["support@acme.com"]}'
expect = "deny"

The result names the rule and field that decided, for example rule 1: body.send. A case without body is evaluated like a request without one, so it never meets body conditions.

Separate test file

Alternatively, keep policy tests separate from a profile—for example, at .stashbase/agent-policy-tests.toml—using [[tests]]:

[[tests]]
name = "GitHub current user remains readable"
secret = "GITHUB_TOKEN"
method = "GET"
host = "api.github.com"
path = "/user"
expect = "allow"

Select the test file explicitly:

stashbase agent policy test --profile github --test-file .stashbase/agent-policy-tests.toml

When a test outcome differs from expect, the command exits with status 1 and reports the decision reason—for example, a matching credential allow rule, an egress denial, or no matching credential allow rule. Add the command to CI to catch unintended policy widening or regressions before an agent run.

See credential rules for the policy semantics these tests exercise.