9e96541b4c
* Add policy engine to web4-governance (Tier 1.5) Configurable rule-based pre-action gating via before_tool_call hook. Rules match by tool name, category, and target pattern (glob/regex). Decisions (allow/deny/warn) enforced or dry-run, recorded in R6 constraints. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * Add policy admin CLI: status, rules, test commands * Add README and update ARCHITECTURE.md for Tier 1.5 policy engine --------- Co-authored-by: dp-web4 <dp@metalinxx.io> Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
98 lines
3.2 KiB
JSON
98 lines
3.2 KiB
JSON
{
|
|
"id": "web4-governance",
|
|
"configSchema": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"properties": {
|
|
"auditLevel": {
|
|
"type": "string",
|
|
"enum": ["minimal", "standard", "verbose"],
|
|
"default": "standard"
|
|
},
|
|
"showR6Status": {
|
|
"type": "boolean",
|
|
"default": true
|
|
},
|
|
"storagePath": {
|
|
"type": "string",
|
|
"description": "Override default ~/.web4/ storage path"
|
|
},
|
|
"policy": {
|
|
"type": "object",
|
|
"description": "Policy engine configuration for pre-action gating",
|
|
"properties": {
|
|
"defaultPolicy": {
|
|
"type": "string",
|
|
"enum": ["allow", "deny", "warn"],
|
|
"default": "allow",
|
|
"description": "Default decision when no rule matches"
|
|
},
|
|
"enforce": {
|
|
"type": "boolean",
|
|
"default": true,
|
|
"description": "When false, deny decisions are logged but not enforced (dry-run)"
|
|
},
|
|
"rules": {
|
|
"type": "array",
|
|
"default": [],
|
|
"items": {
|
|
"type": "object",
|
|
"required": ["id", "name", "priority", "decision", "match"],
|
|
"properties": {
|
|
"id": {
|
|
"type": "string",
|
|
"description": "Unique rule identifier"
|
|
},
|
|
"name": {
|
|
"type": "string",
|
|
"description": "Human-readable rule name"
|
|
},
|
|
"priority": {
|
|
"type": "number",
|
|
"description": "Lower = evaluated first. First match wins."
|
|
},
|
|
"decision": {
|
|
"type": "string",
|
|
"enum": ["allow", "deny", "warn"]
|
|
},
|
|
"reason": {
|
|
"type": "string",
|
|
"description": "Human-readable reason for the decision"
|
|
},
|
|
"match": {
|
|
"type": "object",
|
|
"properties": {
|
|
"tools": {
|
|
"type": "array",
|
|
"items": { "type": "string" },
|
|
"description": "Tool names to match (e.g. Bash, Write)"
|
|
},
|
|
"categories": {
|
|
"type": "array",
|
|
"items": {
|
|
"type": "string",
|
|
"enum": ["file_read", "file_write", "command", "network", "delegation", "state", "mcp", "unknown"]
|
|
},
|
|
"description": "Tool categories to match"
|
|
},
|
|
"targetPatterns": {
|
|
"type": "array",
|
|
"items": { "type": "string" },
|
|
"description": "Patterns to match against the tool target (glob by default)"
|
|
},
|
|
"targetPatternsAreRegex": {
|
|
"type": "boolean",
|
|
"default": false,
|
|
"description": "Treat targetPatterns as regex instead of glob"
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|