Epydios Policy Gateway

Boundary-enforced policy gateway for tool execution with allow/deny rules, step-up approval workflows, and audit logging.

Provides a policy enforcement layer that sits between clients and tool execution, applying allow/deny/step-up approval rules to every tool call. Supports both standalone mode with sandboxed shell and filesystem tools, and proxy mode that routes to downstream servers with namespaced tool merging. Features include 2-minute TTL step-up approvals via local CLI, append-only JSONL evidence logging, separation of duties enforcement, and Docker-based sandboxing with dropped capabilities and network isolation.