PGAR Foundation Playbooks
Runtime · Blueprint · Foundation overview · Policy contracts →
Foundation playbooks define how PGAR works before you wire a specific agent surface. They cover contracts, custody, enforcement, verdicts, attestation, and audit. Read them before boundary playbooks.
Build foundations first. Boundaries describe where control lives. RAG, MCP, and memory are other G.A.I.N series that PGAR gates. Neither replaces SARAC, PEP, or audit.
Implementation order
| # | Playbook | What it defines | Read when |
|---|---|---|---|
| 1 | Policy contracts | SARAC shape the PDP evaluates | Designing PEP-to-PDP payloads |
| 2 | Token & session | What crosses the LLM line (and what never does) | PGAR test, credential stripping |
| 3 | PEP enforcement | Receive, ask PDP, audit, act | Building the choke point |
| 4 | PDP surfaces | ALLOW, DENY, STEP_UP rules | Authoring policy versions |
| 5 | Step-up & attestation | Re-eval after human approval | High-risk actions, four-eyes |
| 6 | Audit & replay | Immutable verdict chain for examiners | Retention, replay packs |
Then boundary playbooks (where each control sits in the request path). Cross-call Manifests, RAG, or Memory for the gated contract or store.
How foundations connect
Every tool proposal at runtime flows: agentic app assembles SARAC → PEP asks PDP → verdict logged → ALLOW reaches downstream or DENY/STEP_UP returns to app.
Worked example: uc-refund-agent
Profile pdp-refund-write-v4. Same three samples as the evidence pack.
| Foundation | Refund request |
|---|---|
| Policy contracts | action: issue_refund, resource.account_id, context.amount_aud |
| Token & session | Staff token stays in the app. Model sees schemas for issue_refund only |
| PEP enforcement | No path from the app to the ledger except this PEP |
| PDP surfaces | $80 ALLOW, $750 STEP_UP (refund_above_auto_approved), purpose mismatch DENY |
| Step-up | Attestation att-2026-03-11-1842, then re-eval ALLOW |
| Audit & replay | v-10041 / v-10058 / v-10062 without opening chat |
HR FAQ skips step-up. Its foundation path is retrieve → DENY if corpus is outside the handbook.
Assurance (after foundations)
| Playbook | Purpose |
|---|---|
| Policy test scenarios | Golden authorization cases in CI |
| Adversarial testing | Bypass attempts, prompt injection against enforcement |
See the Assurance playbooks category in the sidebar for both.