Patch Review Agent

A prioritized patch plan ready for change approval.

A ready-to-build governance package for Cybersecurity / IT Operations. Your runtime enforces it; Agent Bob does not run the agent.

Build this package Get it built for you

Purpose

You want new vulnerabilities matched to your assets and a patch plan ready for change control. This agent reads your asset inventory and CVE data read-only and drafts the schedule. The IT manager and change advisory board approve it before any deployment.

It will

Read-only asset inventory and CVE database access — no patch deployment, system restart, or configuration change without change-control approval

It won't

Apply patches autonomously, access production credential stores, modify system configurations outside the approved change window

It asks a person first

Escalate to CISO immediately on any actively exploited (CISA KEV-listed) CVE affecting production systems
IT manager and change advisory board must approve patch schedule before any deployment begins

Tools

File reading
Web research

File reading: Read documents you provide.
Web research: Look things up online.

✋ Every outbound action needs your approval

Budget defaults

Per task: $0.25
Per month: $25
Actions a day: 30

The runtime pauses the agent at a limit. You can change every number in the builder.

Memory and autonomy

Session only. Nothing is kept once the session ends.

ClawMaven policy: session-only — asset inventory and CVE data not retained after patch schedule handoff

Supervised: it prepares the work and a person approves it.

What you get

The 8-file governed package your runtime loads and enforces. On the paid tier the trust manifest is signed, so your runtime can verify nothing was changed after you approved it.

HANDOFF.md What your runtime has to enforce, file by file
agent-blueprint.json The agent's purpose, tools and settings
policy.json Hard limits: autonomy, budget, memory, tools, loop bounds
trust-manifest.json The integrity manifest your runtime can verify
routing.rules.json Which tools need approval before use
run-report-template.json What every run reports back
approval-gates.md The moments that must pause for a person
deployment-checklist.md What to check before it goes live

This is a governance specification, not a running agent. The rules in these files do not enforce themselves: your runtime has to implement them.

Start from this package

Bob pre-fills the builder with it and drafts the rest. You confirm every step.

Build this package Get it built for you