ARYEH — Scope & Boundary Enforcement

ARYEH is the first of the four Chayyot — the face of the lion, scope enforcer. It classifies whether an agent action falls within a registered covenant scope before execution fires. If the action is out of scope, ARYEH blocks it. If it is at the boundary, ARYEH flags it for review.

What ARYEH does

ARYEH sits at the scope boundary of an agent session. Given a proposed action and a covenant — a structured declaration of what the session is permitted and forbidden to do — it returns a deterministic classification of whether the action is in scope, at the scope boundary, or outside it entirely.

Covenants can express allowed and denied tools, actions, domains, and resources. ARYEH evaluates them against a structural action description — plain string verb or a structured { tool, verb } pair — and returns a four-level verdict with no LLM calls, no network requests, and no side effects.

Install

Both packages have zero runtime dependencies. No model downloads, no service calls, no telemetry. Sub-1ms on all classification paths.

Quick start

Pass ARYEH the action and the covenant scope. It returns the level synchronously.

// TypeScript
import { classify } from '@reshimu/aryeh'

const result = classify({
  action: 'delete records',
  tool:   'database',
  scope: {
    allowedActions: ['read', 'write'],
    deniedTools:    ['database', 'filesystem']
  }
})

// result.level    === 'OUT_OF_SCOPE'
// result.decision === 'BLOCK'

# Python
from reshimu_aryeh import classify

result = classify(
    action="delete records",
    tool="database",
    scope={
        "allowedActions": ["read", "write"],
        "deniedTools":    ["database", "filesystem"]
    }
)

# result.level    == 'OUT_OF_SCOPE'
# result.decision == 'BLOCK'

No scope registered? Pass scope: undefined or omit it — ARYEH returns INDETERMINATE and passes through. The classifier does not block when it has nothing to classify against.

Classification levels

Four levels. OUT_OF_SCOPE is a hard block. BOUNDARY is a soft flag — the action is technically within scope but warrants human review. INDETERMINATE means no covenant was registered, not that the action is safe.

What ARYEH enforces — and what it doesn't

ARYEH enforces structural scope: the list of things a session declared it was allowed and not allowed to do. It does not infer intent, evaluate context, or make risk judgments. That is NESHER's job. ARYEH is a covenant contract, not a risk model.

Enforces:

• Denied tools — agent calls a tool the covenant explicitly forbids.
• Denied actions — agent attempts an action verb the covenant lists as off-limits.
• Denied domains and resources — agent targets a resource class the covenant restricts.
• Allowed-only enforcement (strict mode) — when strictMode: true, anything not on the allowlist is OUT_OF_SCOPE.

Does not enforce:

• Actions that are dangerous but technically within scope — that is NESHER's job.
• Semantic correctness of the action against the context — that is SHOR's job.
• Gray zones where the action is ambiguous — that is PANIM ADAM's job.
• Runtime side effects. ARYEH is a pure classifier. It has no state and writes nothing.

Full reference

The complete reference — every covenant field, structured action format, strictMode semantics, integration examples for LangGraph and Claude Code, and the full test suite — lives in the ARYEH README on GitHub.

ARYEH is the first of the four Chayyot — the Bearers of the Throne. For the theological and architectural depth behind why scope enforcement is the first classifier, not the last, read The Chayyot as Validators.