Policy packs
CHAIN INTACT
acme-baseline 1.0.0
The operator baseline is intersected with whatever a plugin's own manifest declares, and the operator can only ever narrow. A pack cannot grant a capability an author never asked for.
fs:readfs:writenet:fetchskills:invoke
CLAUSE
RULE
EFFECT
PRAE-001
Writes stay in the workspace
capability fs:write · path outside ./src/**, ./tests/**, ./docs/**
capability fs:write · path outside ./src/**, ./tests/**, ./docs/**
DENY
PRAE-002
Credentials are never read by an agent
capability fs:read · path inside ./.env, ./.env.*, **/credentials/**, **/*.pem
capability fs:read · path inside ./.env, ./.env.*, **/credentials/**, **/*.pem
DENY
PRAE-010
The network is an allowlist
capability net:fetch · host not in .acme.internal, registry.npmjs.org, .github.com
capability net:fetch · host not in .acme.internal, registry.npmjs.org, .github.com
ASK
PRAE-011
Network budget
capability net:fetch · more than 20
capability net:fetch · more than 20
ASK
PRAE-020
Deletes are held for a human
tool str_replace_editor, write · command = delete
tool str_replace_editor, write · command = delete
ASK
PRAE-030
Reads are recorded
capability fs:read
capability fs:read
WARN
Ordering
When several rules match one call the strongest effect wins — deny over ask over correct over warn — and every match stays in the trace. That is what makes a pack safe to extend: appending a rule can raise a decision's strength and never lower it.