Manifests

What you'll learn: What manifests are, how to connect a repository, and how to assign manifests to agents.

---

What are manifests?

Manifests are YAML files that define sets of security policies. Instead of creating policies one by one, you connect a GitHub repository containing manifest files and assign them to your agents. Policies are created automatically from the manifest and evaluated by the engine.

Two manifests do not come from a repository at all. owasp-agentic-default and eu-ai-act-minimal are bundled inside the kyvvu package and applied to every agent automatically at registration — no repository, no assignment step, no toggle. On the platform they appear as an ordinary assignment whose repo_id is null, which is what marks a manifest as bundled rather than fetched. See The Bundled Baseline.

Everything else: manifests live in a GitHub repository (e.g. Kyvvu/manifests) and are versioned with Git. When a manifest is updated in the repo, you can resync the assignment to pick up changes.

Connecting a repository

Via the dashboard

1. Go to Manifests page.

2. Click Add Repository.

3. Enter the GitHub URL and a personal access token (optional for public repos).

4. Click Connect.

Via the API

curl -X POST https://platform.kyvvu.com/api/v1/repos \
  -H "Authorization: Bearer <JWT>" \
  -H "Content-Type: application/json" \
  -d '{"owner": "Kyvvu", "name": "manifests", "branch": "main", "token": "ghp_..."}'

Assigning a manifest to an agent

Via the dashboard

1. Go to Manifests page.

2. Click Assign on a manifest.

3. Select the agents to assign to.

4. Click Save.

Via the CLI

kyvvu assign-manifest --agent-id <hash> --repo-id <id> --manifest owasp_agentic_default.yaml

Via the API

curl -X POST https://platform.kyvvu.com/api/v1/assignments \
  -H "Authorization: Bearer <JWT>" \
  -H "Content-Type: application/json" \
  -d '{"agent_id": "<hash>", "repo_id": 1, "manifest_path": "owasp_agentic_default.yaml"}'

Listing manifests and assignments

# List available manifests
kyvvu list-manifests

# List assignments (optionally filtered by agent)
kyvvu list-assignments --agent-id <hash>

Resyncing assignments

When a manifest is updated in the repository, you can resync to pick up changes:

• Dashboard: Click the sync icon on the assignment in the Agents page.

• API: POST /api/v1/assignments/{id}/resync

Resync compares the Git SHA. If unchanged, it's a no-op. If changed, old policies are disabled and new ones created.

Risk filtering

When assigning a manifest, policies with a risk_classification higher than the agent's risk level are automatically skipped. For example, a high-risk-only policy won't be applied to a limited-risk agent.

---

Next steps

• The Bundled Baseline — the two of these manifests that ship inside the kyvvu package, frozen and credential-free

• Creating Policies — create custom policies

• Compound Policies — advanced policy authoring