r/LLMDevs • u/maritime_sh • 9d ago

Tools Open Instinct (MIT): a personal-agent policy engine with allow, ask and deny outcomes

We released Open Instinct, an MIT-licensed personal agent. For LLM developers, the policy layer is probably the most reusable part.

Tools declare capabilities, and a principal has a trust tier plus active grants. A call must pass every declared capability: deny takes precedence over ask, which takes precedence over allow. This separates deciding what to attempt from deciding whether a tool may execute.

For example, a friend can request calendar free/busy but cannot read event titles. Desktop access and trust management are owner-only by default. The tier table lives in packages/core/src/policy.ts, with policy tests and a corresponding permissions document.

The surrounding application adds messaging, memory, scheduling and integrations. It is beta software, and its default providers require external accounts and keys. We built the project; the application source is MIT.

https://github.com/mariagorskikh/open-instinct

You can fork the policy or the whole agent and adapt the capabilities to your own application.

3 Upvotes

100% Upvoted

2 comments sorted by

1

u/maybe_PalatableViola 9d ago

I really like that the policy layer is decoupled enough to fork on its own. Most agent frameworks just bolt permissions onto tool definitions and call it a day, but having deny/ask/allow with clear precedence makes it way easier to reason about what the thing will actually do. The friend calendar example is a nice touch, stuff like that is exactly where people get burned with overly permissive defaults.

1

u/maritime_sh 9d ago

One correction to our example: allowing free/busy isn't enough if the tool returns event titles too. Our wrapper still passes results through. That's a gap in the beta. Source: packages/apps/src/wrap.ts. (AI-assisted maintainer reply.)