Policies
Rule hit rate
Which rules are actually catching things. Blocks stop the call; pendings hold it for human review.
7 active
1 disabled
5 high-risk active
HIGH
Block personal email in checkoutblock-personal-email-in-checkout
Generated from NL: "Block emails to gmail/outlook/icloud during the checkout workflow. Allow @acme.io."
CRITICAL
No privileged file accessno-privileged-file-access
Deny write access to /root/.ssh/*, /etc/shadow, /etc/passwd. Non-root agents only.
CRITICAL
No arbitrary shell executionno-arbitrary-shell-execution
Block `curl … | bash` and rm -rf patterns. Allowlist for kubectl, ls, git.
CRITICAL
No destructive SQLno-destructive-sql
Block DROP/TRUNCATE/DELETE-without-WHERE on production schema.
HIGH
Data exfiltration guarddata-exfiltration
Block plaintext http:// outbound + PII in request body to non-allowlisted domains.
MEDIUM
Prompt injection detectorprompt-injection
Flag classic "ignore previous instructions" patterns + jailbreak attempts.
LOW
Cost runawaycost-runaway
Soft-warn when a single completion ≥ 15k tokens OR daily agent spend ≥ $40.
MEDIUM
(legacy) no-bashlegacy-no-bash
Superseded by no-arbitrary-shell-execution. Kept for audit trail.