Policies
The Shield's policy document: one schema, the
agent-shield package's, carried here verbatim as policies/shield-policy.schema.json.
One document per scope — the organization's in IAM, the application's Rules read
into the team's, the session's — the strictest scope deciding first, the first
decision winning, a lower scope only tightening. The catalogue holds the documents
the platform ships or shows, each wrapped under the catalogue's fields.
| Policy | Id | Scope | Rules | Tool calls | Model tokens | Spend (credits) | Harnesses |
|---|---|---|---|---|---|---|---|
| The default policy | default | session | 10 | 100 then 200 | — | — | every registered one (account) |
| An organization's baseline | organization-baseline | organization | 3 | 100 then 200 | 200000 then 400000 | 500 then 1000 | claude-code, codex (account) |
Each policy
The default policy (default)
The platform's default, the session document every Shield decides with under the organization's and the application's: read, search, edit and move inside the workspace are done; delete, run a command, reach outside the workspace, a command naming a credential, sudo, a package install from the network or git push are asked first with the command shown; a fetch goes through the allow-list, which is empty; send and buy are asked.
- read inside the workspace: allow — read inside the workspace
- edit and move inside the workspace: allow — write inside the workspace
- delete: ask — delete
- a command naming a credential: ask — execute
- sudo: ask — execute
- a package install from the network: ask — execute
- git push: ask — execute
- run a command: ask — execute
- outside the workspace: ask — every class outside the workspace
- send or buy: ask — send, buy
An organization's baseline (organization-baseline)
An example of the organization scope an administrator writes in IAM: running a command asks, nothing is deleted, nothing outside the workspace; the limits with a model budget of 200 000 then 400 000 tokens and a spend limit of 5 then 10 USD (500 then 1 000 credits); fetches to *.datalayer.io alone; Claude Code and Codex admitted, each on the account's own key; reading, writing, running a command, sending and buying need a permission beside the Rules.
- running a command asks: ask — execute
- nothing is deleted: deny — delete
- outside the workspace: leave it to me: deny — every class outside the workspace