Skip to content

Manifests

What you'll learn: What manifests are, how to connect a repository, and how to assign manifests to agents.

What are manifests?

Manifests are YAML files that define sets of security policies. Instead of creating policies one by one, you connect a GitHub repository containing manifest files and assign them to your agents. Policies are created automatically from the manifest and evaluated by the engine.

Two manifests do not come from a repository at all. owasp-agentic-default and eu-ai-act-minimal are bundled in kyvvu-baseline and applied automatically at registration (Claude Code agents get the Claude Code Safety manifest in place of the OWASP one, see the bundled baseline) — no repository and no assignment step. There is no flag or environment variable to switch them off; an owner can unassign them from an agent, and registering again never re-applies them (see Removing and restoring the baseline). On the platform they appear as an ordinary assignment whose repo_id is null, which is what marks a manifest as bundled rather than fetched. See The Bundled Baseline.

Everything else: manifests live in a GitHub repository (e.g. Kyvvu/manifests) and are versioned with Git. When a manifest is updated in the repo, you can resync the assignment to pick up changes.

Connecting a repository

Via the dashboard

  1. Go to Manifests page.
  2. Click Add Repository.
  3. Enter the GitHub URL and a personal access token (optional for public repos).
  4. Click Connect.

Via the API

curl -X POST https://platform.kyvvu.com/api/v1/repos \
  -H "Authorization: Bearer <JWT>" \
  -H "Content-Type: application/json" \
  -d '{"owner": "Kyvvu", "name": "manifests", "branch": "main", "token": "ghp_..."}'

Assigning a manifest to an agent

Via the dashboard

  1. Go to Manifests page.
  2. Click Assign on a manifest.
  3. Select the agents to assign to.
  4. Click Save.

Via the CLI

kyvvu assign-manifest --agent-id <agent key or id> --repo-id <id> --manifest owasp_agentic_default.yaml

Via the API

curl -X POST https://platform.kyvvu.com/api/v1/assignments \
  -H "Authorization: Bearer <JWT>" \
  -H "Content-Type: application/json" \
  -d '{"agent_id": "<hash>", "repo_id": 1, "manifest_path": "owasp_agentic_default.yaml"}'

Listing manifests and assignments

# List available manifests
kyvvu list-manifests

# List assignments (optionally filtered by agent)
kyvvu list-assignments --agent-id <agent key or id>

Resyncing assignments

When a manifest is updated in the repository, you can resync to pick up changes:

  • Dashboard: Click the sync icon on the assignment in the Agents page.
  • API: POST /api/v1/assignments/{id}/resync

Resync compares the Git SHA. If unchanged, it's a no-op. If changed, old policies are disabled and new ones created.

Risk filtering

When assigning a manifest, policies with a risk_classification higher than the agent's risk level are automatically skipped. For example, a high-risk-only policy won't be applied to a limited-risk agent.

Next steps