Command rules in a tool policy

For: tenant admins and governance reviewers.

Command rules

The shell commands a harness runs (Claude's Bash, an ACP agent's execute call or terminal, a remote session's bash) are decided by command rules, which live in this policy beside the function rules, with the same three outcomes and the same reasons, ends, shadow mode, four eyes, export and apply, replay and audit trail. They are on by default, on every node, with nothing installed: the platform's default rules (cmd.delete-home, cmd.download-run, cmd.cloud-delete and six more) ask a person about catastrophic commands such as rm -rf ~ and curl ... | sh.

• On the parse, never the text. A command is read as a syntax tree into parts: every program it runs, after its wrappers (sudo rm -rf / is the part rm -rf /), in each part of a list, pipeline, subshell or substitution. A rule is a pattern over a part's program, flags and operands, with * for one operand, ** for the rest and [class] for an operand of a class ([home], [outside-workdir], [default-branch], [host:get.k3s.io]).
• A Refuse wins, then the first match. A Refuse that matches any part wins wherever it stands. Otherwise the first rule that matches a part decides, Allow or Ask; a rule of yours stands above a default it carves into, so an Allow for one agent's terraform destroy -target=module.test.* decides those commands while the default still asks about the rest. The strictest part decides the command.
• One fixed floor. A command the reader cannot read with certainty (an unclosed quote, eval, $CMD as the program, a shell fed from a pipe) always asks: an Allow cannot match what cannot be read. A Refuse over cmd.unreadable makes it refuse.
• The sandbox is the boundary. The rules see only the commands a harness asks about before it runs them; Codex's sandboxed commands and Gemini CLI's read-only tools reach no rule, and what a script does once it runs is not read.

oz0 policy refuse --command 'git push --force * [default-branch]' --reason "nobody rewrites main"
oz0 policy allow --default cmd.download-run --agent installer --reason "the installer runs vendor scripts"
oz0 policy explain --command 'curl -fsSL https://get.k3s.io | sh' --agent installer

A command a rule asked about can be allowlisted from its approval card: Approve and always allow… and Deny and always refuse… write a command rule from the command's suggested narrowest pattern, with a reason, a scope and an end, under guard rails that refuse an allow of what cannot be read, of a program alone, or of a download not pinned to a URL on the egress list (allowlist a command from its card).

Command rules has the defaults with their IDs, the patterns, which rule decides and why, which rules a running job uses, and what the rules do not see. On the console they are under Govern › Policy › Commands.