[{"data":1,"prerenderedAt":1218},["ShallowReactive",2],{"docs-\u002Fdocs\u002Fv2\u002Fagent\u002Fpolicy":3},{"id":4,"title":5,"body":6,"description":1211,"extension":1212,"meta":1213,"navigation":987,"path":1214,"seo":1215,"stem":1216,"__hash__":1217},"docs\u002Fdocs\u002Fv2\u002Fagent\u002Fpolicy.md","Policy",{"type":7,"value":8,"toc":1201},"minimark",[9,13,25,216,223,228,231,238,251,255,260,273,441,445,451,615,640,646,650,653,656,751,754,873,880,884,887,1085,1088,1092,1095,1189,1197],[10,11,5],"h1",{"id":12},"policy",[14,15,16,17,20,21,24],"p",{},"The ",[18,19,12],"code",{}," block in ",[18,22,23],{},"axon.config.ts"," controls what the agent's capsule subprocess is\nallowed to do. Enforcement is structural — not advisory, not a prompt hint. If a call\nviolates the policy, it does not execute.",[26,27,32],"pre",{"className":28,"code":29,"language":30,"meta":31,"style":31},"language-ts shiki shiki-themes dark-plus","export default defineAgent({\n    policy: {\n        fs: {\n            read:  [\".\u002Fsrc\u002F**\", \".\u002Fpackage.json\"],\n            write: [\".\u002Fsrc\u002F**\", \".\u002FCHANGELOG.md\"],\n            deny:  [\"**\u002F.env*\", \"**\u002Fnode_modules\u002F**\"],\n        },\n        network: {\n            allow: [\"api.github.com\"],\n        },\n        process: {\n            allow: [\"git *\", \"bun *\"],\n            deny:  [\"git push --force*\"],\n        },\n    },\n})\n","ts","",[18,33,34,54,64,72,94,112,130,136,144,157,162,170,187,199,204,210],{"__ignoreMap":31},[35,36,39,43,46,50],"span",{"class":37,"line":38},"line",1,[35,40,42],{"class":41},"sYbnZ","export",[35,44,45],{"class":41}," default",[35,47,49],{"class":48},"sCudf"," defineAgent",[35,51,53],{"class":52},"sTNBD","({\n",[35,55,57,61],{"class":37,"line":56},2,[35,58,60],{"class":59},"s3F5K","    policy:",[35,62,63],{"class":52}," {\n",[35,65,67,70],{"class":37,"line":66},3,[35,68,69],{"class":59},"        fs:",[35,71,63],{"class":52},[35,73,75,78,81,85,88,91],{"class":37,"line":74},4,[35,76,77],{"class":59},"            read:",[35,79,80],{"class":52},"  [",[35,82,84],{"class":83},"sKc5r","\".\u002Fsrc\u002F**\"",[35,86,87],{"class":52},", ",[35,89,90],{"class":83},"\".\u002Fpackage.json\"",[35,92,93],{"class":52},"],\n",[35,95,97,100,103,105,107,110],{"class":37,"line":96},5,[35,98,99],{"class":59},"            write:",[35,101,102],{"class":52}," [",[35,104,84],{"class":83},[35,106,87],{"class":52},[35,108,109],{"class":83},"\".\u002FCHANGELOG.md\"",[35,111,93],{"class":52},[35,113,115,118,120,123,125,128],{"class":37,"line":114},6,[35,116,117],{"class":59},"            deny:",[35,119,80],{"class":52},[35,121,122],{"class":83},"\"**\u002F.env*\"",[35,124,87],{"class":52},[35,126,127],{"class":83},"\"**\u002Fnode_modules\u002F**\"",[35,129,93],{"class":52},[35,131,133],{"class":37,"line":132},7,[35,134,135],{"class":52},"        },\n",[35,137,139,142],{"class":37,"line":138},8,[35,140,141],{"class":59},"        network:",[35,143,63],{"class":52},[35,145,147,150,152,155],{"class":37,"line":146},9,[35,148,149],{"class":59},"            allow:",[35,151,102],{"class":52},[35,153,154],{"class":83},"\"api.github.com\"",[35,156,93],{"class":52},[35,158,160],{"class":37,"line":159},10,[35,161,135],{"class":52},[35,163,165,168],{"class":37,"line":164},11,[35,166,167],{"class":59},"        process:",[35,169,63],{"class":52},[35,171,173,175,177,180,182,185],{"class":37,"line":172},12,[35,174,149],{"class":59},[35,176,102],{"class":52},[35,178,179],{"class":83},"\"git *\"",[35,181,87],{"class":52},[35,183,184],{"class":83},"\"bun *\"",[35,186,93],{"class":52},[35,188,190,192,194,197],{"class":37,"line":189},13,[35,191,117],{"class":59},[35,193,80],{"class":52},[35,195,196],{"class":83},"\"git push --force*\"",[35,198,93],{"class":52},[35,200,202],{"class":37,"line":201},14,[35,203,135],{"class":52},[35,205,207],{"class":37,"line":206},15,[35,208,209],{"class":52},"    },\n",[35,211,213],{"class":37,"line":212},16,[35,214,215],{"class":52},"})\n",[14,217,218,219,222],{},"No policy block means unrestricted access, not denied access. A missing ",[18,220,221],{},"fs"," block gives\nthe agent full filesystem access. Development agents often run without any policy — that\nis intentional. For anything deployed or published, declare explicit rules.",[224,225,227],"h2",{"id":226},"enforcement-layers","Enforcement layers",[14,229,230],{},"Policy is applied at two independent layers. You write it once. The runtime applies it at\nevery layer available on the host.",[14,232,233,237],{},[234,235,236],"strong",{},"Mediator gates"," run inside the capsule on every platform. Every tool call is evaluated\nagainst the policy rules before the function executes. A denied call never reaches the\nfunction body.",[14,239,240,243,244,247,248,250],{},[234,241,242],{},"OS-level enforcement"," runs on Linux when ",[18,245,246],{},"user"," is set. The capsule subprocess runs as\na different system user. Filesystem ACLs derived from the ",[18,249,221],{}," policy are applied at boot.\nSensitive env vars are stripped before the process starts. This layer is independent of\nthe mediator — it closes gaps the mediator can't address.",[224,252,254],{"id":253},"writing-policy","Writing policy",[256,257,259],"h3",{"id":258},"mediator-only-all-platforms","Mediator-only (all platforms)",[14,261,262,263,87,265,268,269,272],{},"The default. Declare ",[18,264,221],{},[18,266,267],{},"network",", and ",[18,270,271],{},"process"," rules. The mediator enforces them.",[26,274,276],{"className":28,"code":275,"language":30,"meta":31,"style":31},"export default defineAgent({\n    policy: {\n        fs: {\n            read:  [\".\u002Fsrc\u002F**\", \".\u002Ftests\u002F**\", \".\u002Fpackage.json\"],\n            write: [\".\u002Fsrc\u002F**\"],\n            deny:  [\"**\u002F.env*\", \"**\u002F*.key\", \"**\u002F*.pem\", \"**\u002Fnode_modules\u002F**\"],\n        },\n        network: {\n            allow: [\"api.github.com\"],\n        },\n        process: {\n            allow: [\"git status\", \"git diff *\", \"git add *\", \"git commit *\", \"bun test\"],\n            deny:  [\"git push --force*\", \"rm -rf *\"],\n        },\n    },\n})\n",[18,277,278,288,294,300,319,329,353,357,363,373,377,383,414,429,433,437],{"__ignoreMap":31},[35,279,280,282,284,286],{"class":37,"line":38},[35,281,42],{"class":41},[35,283,45],{"class":41},[35,285,49],{"class":48},[35,287,53],{"class":52},[35,289,290,292],{"class":37,"line":56},[35,291,60],{"class":59},[35,293,63],{"class":52},[35,295,296,298],{"class":37,"line":66},[35,297,69],{"class":59},[35,299,63],{"class":52},[35,301,302,304,306,308,310,313,315,317],{"class":37,"line":74},[35,303,77],{"class":59},[35,305,80],{"class":52},[35,307,84],{"class":83},[35,309,87],{"class":52},[35,311,312],{"class":83},"\".\u002Ftests\u002F**\"",[35,314,87],{"class":52},[35,316,90],{"class":83},[35,318,93],{"class":52},[35,320,321,323,325,327],{"class":37,"line":96},[35,322,99],{"class":59},[35,324,102],{"class":52},[35,326,84],{"class":83},[35,328,93],{"class":52},[35,330,331,333,335,337,339,342,344,347,349,351],{"class":37,"line":114},[35,332,117],{"class":59},[35,334,80],{"class":52},[35,336,122],{"class":83},[35,338,87],{"class":52},[35,340,341],{"class":83},"\"**\u002F*.key\"",[35,343,87],{"class":52},[35,345,346],{"class":83},"\"**\u002F*.pem\"",[35,348,87],{"class":52},[35,350,127],{"class":83},[35,352,93],{"class":52},[35,354,355],{"class":37,"line":132},[35,356,135],{"class":52},[35,358,359,361],{"class":37,"line":138},[35,360,141],{"class":59},[35,362,63],{"class":52},[35,364,365,367,369,371],{"class":37,"line":146},[35,366,149],{"class":59},[35,368,102],{"class":52},[35,370,154],{"class":83},[35,372,93],{"class":52},[35,374,375],{"class":37,"line":159},[35,376,135],{"class":52},[35,378,379,381],{"class":37,"line":164},[35,380,167],{"class":59},[35,382,63],{"class":52},[35,384,385,387,389,392,394,397,399,402,404,407,409,412],{"class":37,"line":172},[35,386,149],{"class":59},[35,388,102],{"class":52},[35,390,391],{"class":83},"\"git status\"",[35,393,87],{"class":52},[35,395,396],{"class":83},"\"git diff *\"",[35,398,87],{"class":52},[35,400,401],{"class":83},"\"git add *\"",[35,403,87],{"class":52},[35,405,406],{"class":83},"\"git commit *\"",[35,408,87],{"class":52},[35,410,411],{"class":83},"\"bun test\"",[35,413,93],{"class":52},[35,415,416,418,420,422,424,427],{"class":37,"line":189},[35,417,117],{"class":59},[35,419,80],{"class":52},[35,421,196],{"class":83},[35,423,87],{"class":52},[35,425,426],{"class":83},"\"rm -rf *\"",[35,428,93],{"class":52},[35,430,431],{"class":37,"line":201},[35,432,135],{"class":52},[35,434,435],{"class":37,"line":206},[35,436,209],{"class":52},[35,438,439],{"class":37,"line":212},[35,440,215],{"class":52},[256,442,444],{"id":443},"with-os-level-enforcement-linux","With OS-level enforcement (Linux)",[14,446,447,448,450],{},"Add ",[18,449,246],{}," to run the capsule subprocess as a dedicated system user. The runtime handles\neverything else automatically.",[26,452,454],{"className":28,"code":453,"language":30,"meta":31,"style":31},"export default defineAgent({\n    policy: {\n        fs: {\n            read:  [\".\u002Fsrc\u002F**\", \".\u002Ftests\u002F**\", \".\u002Fpackage.json\"],\n            write: [\".\u002Fsrc\u002F**\"],\n            deny:  [\"**\u002F.env*\", \"**\u002F*.key\", \"**\u002Fnode_modules\u002F**\"],\n        },\n        network: {\n            allow: [\"api.github.com\"],\n        },\n        process: {\n            allow: [\"git *\", \"bun test\"],\n            deny:  [\"git push --force*\"],\n        },\n        user: \"axon-agent\",\n        keepEnv: [\"GITHUB_TOKEN\"],\n    },\n})\n",[18,455,456,466,472,478,496,506,524,528,534,544,548,554,568,578,582,593,605,610],{"__ignoreMap":31},[35,457,458,460,462,464],{"class":37,"line":38},[35,459,42],{"class":41},[35,461,45],{"class":41},[35,463,49],{"class":48},[35,465,53],{"class":52},[35,467,468,470],{"class":37,"line":56},[35,469,60],{"class":59},[35,471,63],{"class":52},[35,473,474,476],{"class":37,"line":66},[35,475,69],{"class":59},[35,477,63],{"class":52},[35,479,480,482,484,486,488,490,492,494],{"class":37,"line":74},[35,481,77],{"class":59},[35,483,80],{"class":52},[35,485,84],{"class":83},[35,487,87],{"class":52},[35,489,312],{"class":83},[35,491,87],{"class":52},[35,493,90],{"class":83},[35,495,93],{"class":52},[35,497,498,500,502,504],{"class":37,"line":96},[35,499,99],{"class":59},[35,501,102],{"class":52},[35,503,84],{"class":83},[35,505,93],{"class":52},[35,507,508,510,512,514,516,518,520,522],{"class":37,"line":114},[35,509,117],{"class":59},[35,511,80],{"class":52},[35,513,122],{"class":83},[35,515,87],{"class":52},[35,517,341],{"class":83},[35,519,87],{"class":52},[35,521,127],{"class":83},[35,523,93],{"class":52},[35,525,526],{"class":37,"line":132},[35,527,135],{"class":52},[35,529,530,532],{"class":37,"line":138},[35,531,141],{"class":59},[35,533,63],{"class":52},[35,535,536,538,540,542],{"class":37,"line":146},[35,537,149],{"class":59},[35,539,102],{"class":52},[35,541,154],{"class":83},[35,543,93],{"class":52},[35,545,546],{"class":37,"line":159},[35,547,135],{"class":52},[35,549,550,552],{"class":37,"line":164},[35,551,167],{"class":59},[35,553,63],{"class":52},[35,555,556,558,560,562,564,566],{"class":37,"line":172},[35,557,149],{"class":59},[35,559,102],{"class":52},[35,561,179],{"class":83},[35,563,87],{"class":52},[35,565,411],{"class":83},[35,567,93],{"class":52},[35,569,570,572,574,576],{"class":37,"line":189},[35,571,117],{"class":59},[35,573,80],{"class":52},[35,575,196],{"class":83},[35,577,93],{"class":52},[35,579,580],{"class":37,"line":201},[35,581,135],{"class":52},[35,583,584,587,590],{"class":37,"line":206},[35,585,586],{"class":59},"        user:",[35,588,589],{"class":83}," \"axon-agent\"",[35,591,592],{"class":52},",\n",[35,594,595,598,600,603],{"class":37,"line":212},[35,596,597],{"class":59},"        keepEnv:",[35,599,102],{"class":52},[35,601,602],{"class":83},"\"GITHUB_TOKEN\"",[35,604,93],{"class":52},[35,606,608],{"class":37,"line":607},17,[35,609,209],{"class":52},[35,611,613],{"class":37,"line":612},18,[35,614,215],{"class":52},[14,616,617,618,621,622,625,626,628,629,632,633,636,637,639],{},"At boot, the runtime applies ",[18,619,620],{},"setfacl"," ACLs for ",[18,623,624],{},"axon-agent"," derived from the ",[18,627,221],{},"\npolicy, strips sensitive env vars (preserving ",[18,630,631],{},"GITHUB_TOKEN"," from ",[18,634,635],{},"keepEnv","), and\nlaunches the capsule as ",[18,638,624],{},". The subprocess and everything it spawns runs as\nthat user.",[14,641,642,643,645],{},"On macOS and Windows, ",[18,644,246],{}," has no effect. OS enforcement is Linux only.",[224,647,649],{"id":648},"escalation","Escalation",[14,651,652],{},"For calls where a static allow\u002Fdeny isn't expressive enough, escalation pauses execution\nand surfaces the call for human review.",[14,654,655],{},"Escalation can be declared per-domain with pattern lists:",[26,657,659],{"className":28,"code":658,"language":30,"meta":31,"style":31},"export default defineAgent({\n    policy: {\n        process: {\n            allow:    [\"git *\"],\n            escalate: [\"git push*\"],\n        },\n        fs: {\n            read:     [\".\u002F**\"],\n            escalate: [\".\u002Fsecrets\u002F**\"],\n        },\n    },\n})\n",[18,660,661,671,677,683,694,706,710,716,728,739,743,747],{"__ignoreMap":31},[35,662,663,665,667,669],{"class":37,"line":38},[35,664,42],{"class":41},[35,666,45],{"class":41},[35,668,49],{"class":48},[35,670,53],{"class":52},[35,672,673,675],{"class":37,"line":56},[35,674,60],{"class":59},[35,676,63],{"class":52},[35,678,679,681],{"class":37,"line":66},[35,680,167],{"class":59},[35,682,63],{"class":52},[35,684,685,687,690,692],{"class":37,"line":74},[35,686,149],{"class":59},[35,688,689],{"class":52},"    [",[35,691,179],{"class":83},[35,693,93],{"class":52},[35,695,696,699,701,704],{"class":37,"line":96},[35,697,698],{"class":59},"            escalate:",[35,700,102],{"class":52},[35,702,703],{"class":83},"\"git push*\"",[35,705,93],{"class":52},[35,707,708],{"class":37,"line":114},[35,709,135],{"class":52},[35,711,712,714],{"class":37,"line":132},[35,713,69],{"class":59},[35,715,63],{"class":52},[35,717,718,720,723,726],{"class":37,"line":138},[35,719,77],{"class":59},[35,721,722],{"class":52},"     [",[35,724,725],{"class":83},"\".\u002F**\"",[35,727,93],{"class":52},[35,729,730,732,734,737],{"class":37,"line":146},[35,731,698],{"class":59},[35,733,102],{"class":52},[35,735,736],{"class":83},"\".\u002Fsecrets\u002F**\"",[35,738,93],{"class":52},[35,740,741],{"class":37,"line":159},[35,742,135],{"class":52},[35,744,745],{"class":37,"line":164},[35,746,209],{"class":52},[35,748,749],{"class":37,"line":172},[35,750,215],{"class":52},[14,752,753],{},"Or programmatically with a function when the condition depends on the arguments:",[26,755,757],{"className":28,"code":756,"language":30,"meta":31,"style":31},"export default defineAgent({\n    policy: {\n        escalate: call => {\n            \u002F\u002F call.fn   — e.g. \"fs.write\", \"process.spawn\"\n            \u002F\u002F call.args — the arguments passed to the operation\n            return call.fn === \"process.spawn\" && call.args[0]?.toString().includes(\"--force\")\n        },\n    },\n})\n",[18,758,759,769,775,792,798,803,861,865,869],{"__ignoreMap":31},[35,760,761,763,765,767],{"class":37,"line":38},[35,762,42],{"class":41},[35,764,45],{"class":41},[35,766,49],{"class":48},[35,768,53],{"class":52},[35,770,771,773],{"class":37,"line":56},[35,772,60],{"class":59},[35,774,63],{"class":52},[35,776,777,780,783,786,790],{"class":37,"line":66},[35,778,779],{"class":48},"        escalate",[35,781,782],{"class":59},":",[35,784,785],{"class":59}," call",[35,787,789],{"class":788},"scz_3"," =>",[35,791,63],{"class":52},[35,793,794],{"class":37,"line":74},[35,795,797],{"class":796},"sOLPB","            \u002F\u002F call.fn   — e.g. \"fs.write\", \"process.spawn\"\n",[35,799,800],{"class":37,"line":96},[35,801,802],{"class":796},"            \u002F\u002F call.args — the arguments passed to the operation\n",[35,804,805,808,810,813,816,819,822,825,828,830,833,836,840,843,846,849,852,855,858],{"class":37,"line":114},[35,806,807],{"class":41},"            return",[35,809,785],{"class":59},[35,811,812],{"class":52},".",[35,814,815],{"class":59},"fn",[35,817,818],{"class":52}," === ",[35,820,821],{"class":83},"\"process.spawn\"",[35,823,824],{"class":52}," && ",[35,826,827],{"class":59},"call",[35,829,812],{"class":52},[35,831,832],{"class":59},"args",[35,834,835],{"class":52},"[",[35,837,839],{"class":838},"sDGX8","0",[35,841,842],{"class":52},"]?.",[35,844,845],{"class":48},"toString",[35,847,848],{"class":52},"().",[35,850,851],{"class":48},"includes",[35,853,854],{"class":52},"(",[35,856,857],{"class":83},"\"--force\"",[35,859,860],{"class":52},")\n",[35,862,863],{"class":37,"line":132},[35,864,135],{"class":52},[35,866,867],{"class":37,"line":138},[35,868,209],{"class":52},[35,870,871],{"class":37,"line":146},[35,872,215],{"class":52},[14,874,875,876,879],{},"When a call escalates, the TUI shows the function, module, and arguments and waits for\napproval or denial. In headless execution with no TUI attached, escalations fail closed\nafter the timeout (default 30 seconds, configurable via ",[18,877,878],{},"resources.escalationTimeoutMs",").",[224,881,883],{"id":882},"per-invocation-narrowing","Per-invocation narrowing",[14,885,886],{},"The base policy applies to every invocation. Scripts and routes can narrow it for a\nsingle call:",[26,888,890],{"className":28,"code":889,"language":30,"meta":31,"style":31},"\u002F\u002F server\u002Fapi\u002Fsupport.post.ts\nexport default defineEventHandler(async event => {\n    const ticket = await readBody(event)\n    const prompt = await axon.prompt(\"support-triage\", { ticketId: ticket.id })\n\n    return axon.request({\n        prompt,\n        policy: {\n            fs:      { read: false, write: false },\n            network: { allow: [\"api.stripe.com\"] },\n            process: { allow: [] },\n        },\n    })\n})\n",[18,891,892,897,918,943,983,989,1003,1010,1017,1041,1060,1072,1076,1081],{"__ignoreMap":31},[35,893,894],{"class":37,"line":38},[35,895,896],{"class":796},"\u002F\u002F server\u002Fapi\u002Fsupport.post.ts\n",[35,898,899,901,903,906,908,911,914,916],{"class":37,"line":56},[35,900,42],{"class":41},[35,902,45],{"class":41},[35,904,905],{"class":48}," defineEventHandler",[35,907,854],{"class":52},[35,909,910],{"class":788},"async",[35,912,913],{"class":59}," event",[35,915,789],{"class":788},[35,917,63],{"class":52},[35,919,920,923,927,930,933,936,938,941],{"class":37,"line":66},[35,921,922],{"class":788},"    const",[35,924,926],{"class":925},"s9McN"," ticket",[35,928,929],{"class":52}," = ",[35,931,932],{"class":41},"await",[35,934,935],{"class":48}," readBody",[35,937,854],{"class":52},[35,939,940],{"class":59},"event",[35,942,860],{"class":52},[35,944,945,947,950,952,954,957,959,962,964,967,970,973,975,977,980],{"class":37,"line":74},[35,946,922],{"class":788},[35,948,949],{"class":925}," prompt",[35,951,929],{"class":52},[35,953,932],{"class":41},[35,955,956],{"class":59}," axon",[35,958,812],{"class":52},[35,960,961],{"class":48},"prompt",[35,963,854],{"class":52},[35,965,966],{"class":83},"\"support-triage\"",[35,968,969],{"class":52},", { ",[35,971,972],{"class":59},"ticketId:",[35,974,926],{"class":59},[35,976,812],{"class":52},[35,978,979],{"class":59},"id",[35,981,982],{"class":52}," })\n",[35,984,985],{"class":37,"line":96},[35,986,988],{"emptyLinePlaceholder":987},true,"\n",[35,990,991,994,996,998,1001],{"class":37,"line":114},[35,992,993],{"class":41},"    return",[35,995,956],{"class":59},[35,997,812],{"class":52},[35,999,1000],{"class":48},"request",[35,1002,53],{"class":52},[35,1004,1005,1008],{"class":37,"line":132},[35,1006,1007],{"class":59},"        prompt",[35,1009,592],{"class":52},[35,1011,1012,1015],{"class":37,"line":138},[35,1013,1014],{"class":59},"        policy:",[35,1016,63],{"class":52},[35,1018,1019,1022,1025,1028,1031,1033,1036,1038],{"class":37,"line":146},[35,1020,1021],{"class":59},"            fs:",[35,1023,1024],{"class":52},"      { ",[35,1026,1027],{"class":59},"read:",[35,1029,1030],{"class":788}," false",[35,1032,87],{"class":52},[35,1034,1035],{"class":59},"write:",[35,1037,1030],{"class":788},[35,1039,1040],{"class":52}," },\n",[35,1042,1043,1046,1049,1052,1054,1057],{"class":37,"line":159},[35,1044,1045],{"class":59},"            network:",[35,1047,1048],{"class":52}," { ",[35,1050,1051],{"class":59},"allow:",[35,1053,102],{"class":52},[35,1055,1056],{"class":83},"\"api.stripe.com\"",[35,1058,1059],{"class":52},"] },\n",[35,1061,1062,1065,1067,1069],{"class":37,"line":164},[35,1063,1064],{"class":59},"            process:",[35,1066,1048],{"class":52},[35,1068,1051],{"class":59},[35,1070,1071],{"class":52}," [] },\n",[35,1073,1074],{"class":37,"line":172},[35,1075,135],{"class":52},[35,1077,1078],{"class":37,"line":189},[35,1079,1080],{"class":52},"    })\n",[35,1082,1083],{"class":37,"line":201},[35,1084,215],{"class":52},[14,1086,1087],{},"Narrowing can only restrict. A call cannot grant access to something the base policy\nalready denies. The narrowed policy is cleared when the invocation completes.",[224,1089,1091],{"id":1090},"resource-limits","Resource limits",[14,1093,1094],{},"Alongside access control, policy accepts resource limits that cap what the agent can\nconsume across a session:",[26,1096,1098],{"className":28,"code":1097,"language":30,"meta":31,"style":31},"export default defineAgent({\n    policy: {\n        fs: { read: [\".\u002F**\"] },\n        resources: {\n            maxMemoryMb:        512,\n            maxCommandTimeMs:   30_000,\n            maxFileReadBytes:   10_000_000,\n            maxNetworkRequests: 50,\n        },\n    },\n})\n",[18,1099,1100,1110,1116,1130,1137,1147,1157,1167,1177,1181,1185],{"__ignoreMap":31},[35,1101,1102,1104,1106,1108],{"class":37,"line":38},[35,1103,42],{"class":41},[35,1105,45],{"class":41},[35,1107,49],{"class":48},[35,1109,53],{"class":52},[35,1111,1112,1114],{"class":37,"line":56},[35,1113,60],{"class":59},[35,1115,63],{"class":52},[35,1117,1118,1120,1122,1124,1126,1128],{"class":37,"line":66},[35,1119,69],{"class":59},[35,1121,1048],{"class":52},[35,1123,1027],{"class":59},[35,1125,102],{"class":52},[35,1127,725],{"class":83},[35,1129,1059],{"class":52},[35,1131,1132,1135],{"class":37,"line":74},[35,1133,1134],{"class":59},"        resources:",[35,1136,63],{"class":52},[35,1138,1139,1142,1145],{"class":37,"line":96},[35,1140,1141],{"class":59},"            maxMemoryMb:",[35,1143,1144],{"class":838},"        512",[35,1146,592],{"class":52},[35,1148,1149,1152,1155],{"class":37,"line":114},[35,1150,1151],{"class":59},"            maxCommandTimeMs:",[35,1153,1154],{"class":838},"   30_000",[35,1156,592],{"class":52},[35,1158,1159,1162,1165],{"class":37,"line":132},[35,1160,1161],{"class":59},"            maxFileReadBytes:",[35,1163,1164],{"class":838},"   10_000_000",[35,1166,592],{"class":52},[35,1168,1169,1172,1175],{"class":37,"line":138},[35,1170,1171],{"class":59},"            maxNetworkRequests:",[35,1173,1174],{"class":838}," 50",[35,1176,592],{"class":52},[35,1178,1179],{"class":37,"line":146},[35,1180,135],{"class":52},[35,1182,1183],{"class":37,"line":159},[35,1184,209],{"class":52},[35,1186,1187],{"class":37,"line":164},[35,1188,215],{"class":52},[14,1190,1191,1192,812],{},"For the complete field reference — all options, types, and defaults — see\n",[1193,1194,1196],"a",{"href":1195},"\u002Fdocs\u002Fv2\u002Fapi\u002Fconfig\u002Fpolicy","Policy reference",[1198,1199,1200],"style",{},"html pre.shiki code .sYbnZ, html code.shiki .sYbnZ{--shiki-default:#C586C0}html pre.shiki code .sCudf, html code.shiki .sCudf{--shiki-default:#DCDCAA}html pre.shiki code .sTNBD, html code.shiki .sTNBD{--shiki-default:#D4D4D4}html pre.shiki code .s3F5K, html code.shiki .s3F5K{--shiki-default:#9CDCFE}html pre.shiki code .sKc5r, html code.shiki .sKc5r{--shiki-default:#CE9178}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html pre.shiki code .scz_3, html code.shiki .scz_3{--shiki-default:#569CD6}html pre.shiki code .sOLPB, html code.shiki .sOLPB{--shiki-default:#6A9955}html pre.shiki code .sDGX8, html code.shiki .sDGX8{--shiki-default:#B5CEA8}html pre.shiki code .s9McN, html code.shiki .s9McN{--shiki-default:#4FC1FF}",{"title":31,"searchDepth":56,"depth":56,"links":1202},[1203,1204,1208,1209,1210],{"id":226,"depth":56,"text":227},{"id":253,"depth":56,"text":254,"children":1205},[1206,1207],{"id":258,"depth":66,"text":259},{"id":443,"depth":66,"text":444},{"id":648,"depth":56,"text":649},{"id":882,"depth":56,"text":883},{"id":1090,"depth":56,"text":1091},"The policy block in axon.config.ts controls what the agent's capsule subprocess is\nallowed to do. Enforcement is structural — not advisory, not a prompt hint. If a call\nviolates the policy, it does not execute.","md",{},"\u002Fdocs\u002Fv2\u002Fagent\u002Fpolicy",{"title":5,"description":1211},"docs\u002Fv2\u002Fagent\u002Fpolicy","VIXyGESoPbrPprZZ-gh-MnDFom4isRujwIcPlAil0ig",1785671805743]