Policy
Risk tiers
The policy model is built on risk tiering: the higher a tool's potential for harm, the more controls apply.
| Tier | Example tools | Default behaviour |
|---|---|---|
| Read-only | lookup_order, get_customer | ALLOW free. The egress scan still runs. |
| Write | issue_refund, update_record | Allowed but argument-constrained: threshold, regex, enum. |
| External effect / irreversible | send_email, money movement, deletion | ESCALATE human approval; or allow: false. |
| Unlisted | — | BLOCK (unlisted_tools: deny). |
Policy design principles
- Close first, then open. Start from an empty policy and add the tools the agent's job needs one by one.
- Derive thresholds from business rules. Like "refunds over 500 need approval".
- Put approval on externally-effecting tools and leave
egress_scanon. - Measure with shadow. Run a new policy in shadow before going live to see what it would block.