Linting a policy before it ships

agt lint-policy is the command that reads a YAML policy file and reports the mistakes that would stop it loading, before the policy reaches a running agent.

Last updated: 14 Oct, 2026 · Agent Governance Toolkit 4.1.0

The policy-in-a-file lesson wrote rules as YAML. A policy that fails to load leaves the gate empty, which the fail-open default turns into an open door. Linting on the command line catches that in a pipeline, before it ships.

A policy that lints clean

This is the shop policy from earlier: a version, a name, two rules, and a deny default. Save it as good.yaml.

version: "1.0"
name: shop-policy
rules:
  - name: allow-status
    condition: {field: action, operator: eq, value: order_status}
    action: allow
    priority: 10
  - name: block-delete
    condition: {field: action, operator: eq, value: delete_account}
    action: deny
    priority: 100
defaults:
  action: deny

agt lint-policy reads the file and reports what it finds.

agt lint-policy good.yaml

No issues found.

Catching a malformed policy

This file uses a different, nested shape, the one some tools write. It has no top-level version, name or rules, so it would load as an empty policy. Save it as broken.yaml.

policies:
  - rules:
      - conditions: ["output contains 'password'"]
        action: block

The linter names each missing field and the line it was expected on.

agt lint-policy broken.yaml

broken.yaml:1: error: Missing required field 'version'
broken.yaml:1: error: Missing required field 'name'
broken.yaml:1: error: Missing required field 'rules'

3 error(s) found.

What the linter checks

• The required top-level fields, version, name and rules, without which the policy loads as empty.
• The shape of each rule, so a rule that could never match is caught before it ships.
• It does not run the policy. Linting is a shape check; the test command replays real decisions against it.

lint-policy vs agt test

Where you use lint-policy

• A pre-commit hook that rejects a policy file with a shape error before it is merged.
• A CI step on any change to a policy, so a broken file never reaches a deployment.
• A quick check while writing a policy by hand, to catch a typo in a field name.

Related

• Previous: Merkle proofs and CloudEvents
• Next: Testing a policy from the command line