# AgentGuard Spend task template: code-scan
# Local-only policy file. Prompts, completions, API keys, and signing keys stay in the customer runtime.
id: code-scan-v1
name: Code scan agent
version: 1
effectiveFrom: "2026-05-27T00:00:00.000Z"
mode: enforce
requiredCapability: read_only
scope:
  tenantId: my-tenant
models:
  primary: google/gemini-3-flash-preview
  fallback: openai/gpt-4o-mini
  allowed:
    - google/gemini-3-flash-preview
    - openai/gpt-4o-mini
caps:
  # WHY: 10 cents per call bounds one agent action while keeping normal work flowing.
  - amountCents: 10
    window: per_call
    action: downgrade
    downgradeTo: openai/gpt-4o-mini
    reason: "Per-call budget reached, routing to fallback model"
  # WHY: Daily cap catches loops and unexpected traffic before monthly budgets drift.
  - amountCents: 3000
    window: per_day
    action: block
    reason: "Daily budget reached"
systemInstructions: |
  Scan code for spend, audit, and integration risks. Return findings with file paths and minimal fix guidance.