Deterministic, verifiable policy for autonomous agents.

For security architects, platform teams and CISOs

Works alongside what you run. Keep OPA, Cedar and IAM for the access they already control. MAPL adds what agents need on top: authority that follows the person through every agent and service, approvals, and checks on what each call actually does.

The problem

Policy languages were built for known callers making known requests.
Agents act for people, delegate to other agents, chain calls across teams’ services, and decide what to do at runtime.
Guardrails judge the words of a request, and words can be reworded.

What MAPL does

Decides every tool, model and agent call before it runs: allow, deny, or pending a named approver.
Every policy has four parts: allowed resources, denied resources, parameter constraints, approvals.
Your IdP says who is asking; every policy with a say in the call is intersected into one.

What’s different

Many authors, one algebra. Authority only narrows as policies combine; a deny is final.
Bound at call time. Policies name scopes, not people.
Caller and service both decide. A compromised caller still meets the service’s limits.
Approvals the agent can’t supply. From people, token claims or tools, never the agent.
Hooks that only tighten. Python extractors, input verifiers and result processors.

You say

“Alice can read employee records, up to 100 at a time. Any update needs a manager’s approval. Deletes aren’t allowed.”

The MAPL skill writes

"resources": ["tool:emp_records/read", "tool:emp_records/update"],
"denied_resources": ["tool:emp_records/delete"],
"tool:emp_records/read": { "limit": { "max": 100 } },
"tool:emp_records/update": { "attestations": ["manager_approval"] }

Assurance, scoped

Proved: In Lean: composition only narrows, a deny is final, order doesn’t matter, your functions only tighten, the requester never supplies its own evidence, and no approval is used twice.
Enforced: By the MACAW runtime on protected paths: approvals and records are signed, and calls are checked where they are made.
Measured: AgentDojo: 0 of 949 attacks took effect. τ²-bench: 52 of 56 written rules stated, 36 of 36 rule-breaking calls refused.

Technical matrix

How MAPL compares

Capability		MAPL	Cedar	OPA/Rego	AWS IAM	OpenFGA	NeMo
Composition	Authority only narrows as policies compose, proved	●	◐	◐	◐	○	○
	Explicit deny cannot be overridden	●	●	◐	●	◐	◐
	Caller and service policies both constrain access	●	◐	◐	◐	◐	○
	Policies attached to data and objects	●	●	◐	●	●	○
	Restrictions follow derived data through references	●	○	◐	○	◐	○
Identity and delegation	Identity bound from IdP claims at call time	●	◐	◐	◐	◐	○
Identity and delegation	Authority narrows at every agent hop	●	○	◐	◐	◐	○
Agent actions	Native model, tool and MCP resources	●	◐	◐	○	○	◐
Agent actions	Model, parameter and token constraints	●	◐	◐	○	○	◐
Approvals and evidence	Named approvers, conditions, pending decisions, expiry	●	○	◐	○	○	◐
Approvals and evidence	Signed, single-use evidence the agent can’t forge	●	○	○	○	○	○
Extensibility and assurance	Custom logic that can only tighten a decision	●	○	◐	○	◐	◐
	Rich logic over structured request data	●	◐	●	○	◐	◐
	Mechanized proofs (Lean)	●	●	○	◐	○	○
	Validated before deployment; effective policy explained	●	●	◐	●	◐	○

● built in · ◐ partial, or with custom code · ○ not supported. From each project’s public documentation, November 2026. MAPL supplies the policy semantics; signing, the approval lifecycle, cross-hop delegation and enforcement are capabilities of the MACAW runtime, on protected execution paths.