pkg/wasmsdkThe scaffolded path. Compile with GOOS=wasip1 GOARCH=wasm; the CLI handles this automatically.
Entrovik policy developer guide
Build enterprise AI policy. Ship sandboxed WASM.
Write policy once against normalized AI content, run it across providers, and distribute it as a versioned, integrity-checked package—without adding native code to the gateway.
ABI JSON v1RUNTIMES Go · RustTARGET WASI Preview 1SANDBOX Deny by default
Five-minute author loop
From empty directory to validated policy package.
The CLI scaffolds a working Go guest, compiles it for WASI, updates its integrity digest, executes ABI conformance checks, and creates a deterministic package.
- 01Scaffold
Create the manifest, Go guest, configuration schema, module, and README.
- 02Implement
Evaluate normalized messages and return an explicit policy action.
- 03Prove
Compile and run every declared stage through the isolated runtime.
- 04Distribute
Sign the manifest, package the artifacts, and publish or upload them.
# Requires Go 1.25+ and the Entrovik CLI entrovik policy init acme-data-rule ./acme-data-rule $EDITOR ./acme-data-rule/main.go entrovik policy build ./acme-data-rule entrovik policy test ./acme-data-rule entrovik policy package ./acme-data-rule ./acme-data-rule-0.1.0.epkg # Upload repeats validation inside the server entrovik package upload ./acme-data-rule
Package contract
Everything needed to evaluate, configure, trust, and operate one policy.
A package is a small, reviewable supply-chain unit. Core discovers behavior from the manifest; adding a policy requires no Entrovik gateway changes.
acme-data-rule/0.1.0
- ◆policy.yamlidentity, runtime, stages, trust
- Wpolicy.wasmisolated policy executable
- { }config.schema.jsonadministrator configuration contract
- ¶README.mdoperator and reviewer documentation
apiVersion: entrovik.com/v1 kind: Policy metadata: name: acme-data-rule version: 0.1.0 publisher: acme-security runtime: type: wasm module: policy.wasm abiVersion: v1 stages: [before_provider, before_response] permissions: network: false filesystem: false environment: false failurePolicy: deny integrity: sha256: <set by entrovik policy build>
Guest SDK
Evaluate normalized content. Return a decision.
The guest sees stable ABI values—not OpenAI, Anthropic, or Gemini wire structs. Its output is declarative, bounded, and validated by Core before any mutation is applied.
Understand ABI v1 ↓package main import ( "strings" "github.com/hiperfusion/entrovik/pkg/wasmsdk" ) func evaluate(input wasmsdk.Input) wasmsdk.Output { marker, _ := input.PolicyConfig["marker"].(string) for _, message := range input.Messages { if marker != "" && strings.Contains(message.Content, marker) { return wasmsdk.Deny("confidential marker detected") } } return wasmsdk.Allow() } func main() { wasmsdk.Run(evaluate) }
ABI v1
Portable inputs. Explicit outputs. No host internals.
Core serializes one bounded JSON document to the guest and accepts one bounded JSON result. Unknown fields, extra documents, invalid paths, unsupported operations, and malformed output fail evaluation.
Context without provider coupling
- Stage and request ID
- Tenant and caller identity
- Application, team, and roles
- Provider and model
- Normalized message paths
- Validated policy configuration
One enforceable decision
alloworwarndenywith a safe reasonredactwith replacementsmutatenormalized pathsannotateaudit context- Structured category and severity
{
"action": "redact",
"reason": "Customer identifier detected",
"annotations": {
"category": "customer-data",
"severity": "high"
},
"mutations": [{
"op": "replace",
"path": "request.messages[0].content",
"value": "[CUSTOMER_DATA]"
}]
}
Sandbox and failure model
Treat every external policy as untrusted code.
Policies execute server-side under wazero. The browser never evaluates policy code, and packages cannot load native plugins or escape through ambient host capabilities.
No network, filesystem, environment, or process execution
ABI v1 supplies policy data through serialized input. Default manifests cannot request hidden access to the host.
Timeout, memory, input, output, and concurrency ceilings
Infinite loops, oversized data, initialization stalls, traps, and malformed output are contained without crashing the gateway.
Choose deny or allow on evaluation failure
Security-sensitive packages should declare failurePolicy: deny. The behavior is visible to operators and audit records.
Digest, publisher, key ID, and Ed25519 verification
Enterprise trust policy can reject unsigned packages and accept only approved publisher keys before code is stored or initialized.
Release workflow
Promote policy with the same discipline as production code.
Keep signing keys outside source control, version every behavioral change, simulate against representative traffic, and let the server repeat validation at the trust boundary.
- Use semantic versions and immutable package digests
- Review configuration schema and failure behavior
- Sign with an approved publisher key
- Roll out through a versioned pipeline revision
# One-time publisher key generation entrovik policy keygen publisher.key publisher.pub # Keep publisher.key offline or in controlled CI entrovik policy sign ./acme-data-rule publisher.key acme-2026 entrovik policy test ./acme-data-rule entrovik policy package ./acme-data-rule ./acme-data-rule-0.1.0.epkg # Publish to an authenticated OCI policy repository entrovik hub publish ./acme-data-rule \ oci://registry.example.com/acme-data-rule:0.1.0
Build your policy ecosystem
Turn institutional rules into portable enforcement.
Bring a use case, an existing detector, or a compliance requirement. We’ll map it to the ABI, package lifecycle, test strategy, and production rollout.