Apparitor: Authorization rail for NeMo Guardrails (checks tool calls against your policy engine)

[jhawlwut]

Most rails here check content (PII, jailbreaks, moderation). This one checks something different: whether the agent is allowed to make a given tool call, against a policy engine you already run. It registers as a custom action and refuses the call if it's denied, or if the policy service is down (fail-closed). This adds / speaks AuthZEN, so it asks whatever you run (OpenFGA, Cedar, OPA) for the requested permission check.

https://github.com/jhawlwut/apparitor

Hoping for some early testers and feedback on this project.