[{"data":1,"prerenderedAt":855},["ShallowReactive",2],{"i-mdi:magnify":3,"i-simple-icons:visualstudiocode":8,"i-mdi:github":11,"i-mdi:discord":13,"i-mdi:youtube":15,"i-mdi:flask-outline":17,"i-vscode-icons:default-folder-opened":19,"i-vscode-icons:folder-type-node":22,"i-vscode-icons:folder-type-server":24,"i-vscode-icons:folder-type-api":26,"i-vscode-icons:folder-type-plugin":28,"i-vscode-icons:folder-type-src":30,"i-vscode-icons:default-folder":32,"i-vscode-icons:folder-type-script":34,"i-vscode-icons:folder-type-tools":36,"i-vscode-icons:file-type-vue":38,"i-vscode-icons:folder-type-test":40,"i-vscode-icons:file-type-dotenv":42,"i-vscode-icons:file-type-typescript":44,"i-vscode-icons:file-type-json":46,"docs-\u002Fdocs\u002Fv2\u002Fconcepts\u002Fkernel-and-policy":48},{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":7},0,24,false,"\u003Cpath fill=\"currentColor\" d=\"M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5l-1.5 1.5l-5-5v-.79l-.27-.27A6.52 6.52 0 0 1 9.5 16A6.5 6.5 0 0 1 3 9.5A6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14S14 12 14 9.5S12 5 9.5 5\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":9,"hidden":10},"\u003Cpath fill=\"currentColor\" d=\"M23.15 2.587L18.21.21a1.49 1.49 0 0 0-1.705.29l-9.46 8.63l-4.12-3.128a1 1 0 0 0-1.276.057L.327 7.261A1 1 0 0 0 .326 8.74L3.899 12L.326 15.26a1 1 0 0 0 .001 1.479L1.65 17.94a1 1 0 0 0 1.276.057l4.12-3.128l9.46 8.63a1.49 1.49 0 0 0 1.704.29l4.942-2.377A1.5 1.5 0 0 0 24 20.06V3.939a1.5 1.5 0 0 0-.85-1.352m-5.146 14.861L10.826 12l7.178-5.448z\"\u002F>",true,{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":12},"\u003Cpath fill=\"currentColor\" d=\"M12 2A10 10 0 0 0 2 12c0 4.42 2.87 8.17 6.84 9.5c.5.08.66-.23.66-.5v-1.69c-2.77.6-3.36-1.34-3.36-1.34c-.46-1.16-1.11-1.47-1.11-1.47c-.91-.62.07-.6.07-.6c1 .07 1.53 1.03 1.53 1.03c.87 1.52 2.34 1.07 2.91.83c.09-.65.35-1.09.63-1.34c-2.22-.25-4.55-1.11-4.55-4.92c0-1.11.38-2 1.03-2.71c-.1-.25-.45-1.29.1-2.64c0 0 .84-.27 2.75 1.02c.79-.22 1.65-.33 2.5-.33s1.71.11 2.5.33c1.91-1.29 2.75-1.02 2.75-1.02c.55 1.35.2 2.39.1 2.64c.65.71 1.03 1.6 1.03 2.71c0 3.82-2.34 4.66-4.57 4.91c.36.31.69.92.69 1.85V21c0 .27.16.59.67.5C19.14 20.16 22 16.42 22 12A10 10 0 0 0 12 2\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":14,"hidden":10},"\u003Cpath fill=\"currentColor\" d=\"m22 24l-5.25-5l.63 2H4.5A2.5 2.5 0 0 1 2 18.5v-15A2.5 2.5 0 0 1 4.5 1h15A2.5 2.5 0 0 1 22 3.5V24M12 6.8c-2.68 0-4.56 1.15-4.56 1.15c1.03-.92 2.83-1.45 2.83-1.45l-.17-.17c-1.69.03-3.22 1.2-3.22 1.2c-1.72 3.59-1.61 6.69-1.61 6.69c1.4 1.81 3.48 1.68 3.48 1.68l.71-.9c-1.25-.27-2.04-1.38-2.04-1.38S9.3 14.9 12 14.9s4.58-1.28 4.58-1.28s-.79 1.11-2.04 1.38l.71.9s2.08.13 3.48-1.68c0 0 .11-3.1-1.61-6.69c0 0-1.53-1.17-3.22-1.2l-.17.17s1.8.53 2.83 1.45c0 0-1.88-1.15-4.56-1.15m-2.07 3.79c.65 0 1.18.57 1.17 1.27c0 .69-.52 1.27-1.17 1.27c-.64 0-1.16-.58-1.16-1.27c0-.7.51-1.27 1.16-1.27m4.17 0c.65 0 1.17.57 1.17 1.27c0 .69-.52 1.27-1.17 1.27c-.64 0-1.16-.58-1.16-1.27c0-.7.51-1.27 1.16-1.27Z\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":16},"\u003Cpath fill=\"currentColor\" d=\"m10 15l5.19-3L10 9zm11.56-7.83c.13.47.22 1.1.28 1.9c.07.8.1 1.49.1 2.09L22 12c0 2.19-.16 3.8-.44 4.83c-.25.9-.83 1.48-1.73 1.73c-.47.13-1.33.22-2.65.28c-1.3.07-2.49.1-3.59.1L12 19c-4.19 0-6.8-.16-7.83-.44c-.9-.25-1.48-.83-1.73-1.73c-.13-.47-.22-1.1-.28-1.9c-.07-.8-.1-1.49-.1-2.09L2 12c0-2.19.16-3.8.44-4.83c.25-.9.83-1.48 1.73-1.73c.47-.13 1.33-.22 2.65-.28c1.3-.07 2.49-.1 3.59-.1L12 5c4.19 0 6.8.16 7.83.44c.9.25 1.48.83 1.73 1.73\"\u002F>",{"left":4,"top":4,"width":5,"height":5,"rotate":4,"vFlip":6,"hFlip":6,"body":18},"\u003Cpath fill=\"currentColor\" d=\"M5 19a1 1 0 0 0 1 1h12a1 1 0 0 0 1-1c0-.21-.07-.41-.18-.57L13 8.35V4h-2v4.35L5.18 18.43c-.11.16-.18.36-.18.57m1 3a3 3 0 0 1-3-3c0-.6.18-1.16.5-1.63L9 7.81V6a1 1 0 0 1-1-1V4a2 2 0 0 1 2-2h4a2 2 0 0 1 2 2v1a1 1 0 0 1-1 1v1.81l5.5 9.56c.32.47.5 1.03.5 1.63a3 3 0 0 1-3 3zm7-6l1.34-1.34L16.27 18H7.73l2.66-4.61zm-.5-4a.5.5 0 0 1 .5.5a.5.5 0 0 1-.5.5a.5.5 0 0 1-.5-.5a.5.5 0 0 1 .5-.5\"\u002F>",{"left":4,"top":4,"width":20,"height":20,"rotate":4,"vFlip":6,"hFlip":6,"body":21},32,"\u003Cpath fill=\"#dcb67a\" d=\"M27.4 5.5h-9.2l-2.1 4.2H4.3v16.8h25.2v-21Zm0 18.7H6.6V11.8h20.8Zm0-14.5h-8.2l1-2.1h7.1v2.1Z\"\u002F>\u003Cpath fill=\"#dcb67a\" d=\"M25.7 13.7H.5l3.8 12.8h25.2z\"\u002F>",{"left":4,"top":4,"width":20,"height":20,"rotate":4,"vFlip":6,"hFlip":6,"body":23},"\u003Cpath fill=\"#8ebf55\" d=\"M27.5 5.5h-9.3l-2.1 4.2H4.4v16.8h25.2v-21Zm0 4.2h-8.2l1.1-2.1h7.1Z\"\u002F>\u003Cpath fill=\"#fff\" d=\"M21.688 31a1.6 1.6 0 0 1-.807-.216l-2.57-1.52c-.383-.215-.2-.291-.07-.335A5 5 0 0 0 19.4 28.4a.2.2 0 0 1 .191.015l1.974 1.172a.26.26 0 0 0 .239 0l7.7-4.442a.24.24 0 0 0 .118-.208v-8.881a.25.25 0 0 0-.119-.212l-7.692-4.438a.24.24 0 0 0-.238 0l-7.693 4.439a.25.25 0 0 0-.122.211v8.881a.24.24 0 0 0 .121.206l2.108 1.218c1.144.572 1.845-.1 1.845-.778v-8.769a.22.22 0 0 1 .223-.222h.976a.22.22 0 0 1 .222.222v8.769a2.132 2.132 0 0 1-2.278 2.4A3.3 3.3 0 0 1 15.2 27.5l-2.018-1.162a1.63 1.63 0 0 1-.807-1.4v-8.882a1.62 1.62 0 0 1 .807-1.4l7.7-4.447a1.69 1.69 0 0 1 1.617 0l7.7 4.447a1.62 1.62 0 0 1 .808 1.4v8.881a1.63 1.63 0 0 1-.808 1.4l-7.7 4.443a1.6 1.6 0 0 1-.811.22\"\u002F>\u003Cpath fill=\"#fff\" d=\"M20.231 21.965a.22.22 0 0 1 .222-.222h1a.22.22 0 0 1 .221.188c.15 1.013.6 1.524 2.634 1.524c1.621 0 2.311-.367 2.311-1.227c0-.5-.2-.864-2.715-1.111c-2.106-.208-3.408-.674-3.408-2.358c0-1.553 1.309-2.479 3.5-2.479c2.466 0 3.685.856 3.84 2.691a.22.22 0 0 1-.221.242h-1a.22.22 0 0 1-.216-.174c-.239-1.066-.823-1.407-2.4-1.407c-1.77 0-1.975.617-1.975 1.079c0 .56.243.723 2.632 1.039c2.365.313 3.488.755 3.488 2.418s-1.4 2.637-3.836 2.637c-3.372.002-4.077-1.543-4.077-2.84\"\u002F>",{"left":4,"top":4,"width":20,"height":20,"rotate":4,"vFlip":6,"hFlip":6,"body":25},"\u003Cdefs>\u003ClinearGradient id=\"SVGdWbdmbkP\" x1=\"127.346\" x2=\"125.823\" y1=\"-116.408\" y2=\"-119.26\" gradientTransform=\"matrix(.864 0 0 -.864 -81.843 -76.99)\" gradientUnits=\"userSpaceOnUse\">\u003Cstop offset=\"0\" stop-color=\"#fff\"\u002F>\u003Cstop offset=\"1\" stop-color=\"#fff\"\u002F>\u003C\u002FlinearGradient>\u003ClinearGradient id=\"SVG8lm6nc8b\" x1=\"127.349\" x2=\"125.824\" y1=\"-116.274\" y2=\"-119.127\" gradientTransform=\"matrix(.864 0 0 -.864 -81.843 -76.99)\" gradientUnits=\"userSpaceOnUse\">\u003Cstop offset=\"0\"\u002F>\u003Cstop offset=\"1\" stop-color=\"#6a6a6a\"\u002F>\u003C\u002FlinearGradient>\u003ClinearGradient id=\"SVGAPCDfbiV\" x1=\"126.507\" x2=\"128.647\" y1=\"-131.222\" y2=\"-131.222\" gradientTransform=\"matrix(.864 0 0 -.864 -90.788 -94.496)\" gradientUnits=\"userSpaceOnUse\">\u003Cstop offset=\"0\" stop-color=\"#e7ebef\"\u002F>\u003Cstop offset=\"1\" stop-color=\"#c4ce00\"\u002F>\u003C\u002FlinearGradient>\u003ClinearGradient id=\"SVGAxOVFe2Z\" x1=\"127.346\" x2=\"125.823\" y1=\"-117.409\" y2=\"-120.262\" gradientTransform=\"matrix(.864 0 0 -.864 -81.843 -78.528)\" href=\"#SVGdWbdmbkP\"\u002F>\u003ClinearGradient id=\"SVGlZ3Pqc9R\" x1=\"127.349\" x2=\"125.824\" y1=\"-117.276\" y2=\"-120.128\" gradientTransform=\"matrix(.864 0 0 -.864 -81.843 -78.528)\" href=\"#SVG8lm6nc8b\"\u002F>\u003ClinearGradient id=\"SVGbfvqkd4a\" x1=\"127.346\" x2=\"125.823\" y1=\"-118.411\" y2=\"-121.263\" gradientTransform=\"matrix(.864 0 0 -.864 -81.843 -80.066)\" href=\"#SVGdWbdmbkP\"\u002F>\u003ClinearGradient id=\"SVG9bgFBcXH\" x1=\"127.349\" x2=\"125.824\" y1=\"-118.277\" y2=\"-121.13\" gradientTransform=\"matrix(.864 0 0 -.864 -81.843 -80.066)\" href=\"#SVG8lm6nc8b\"\u002F>\u003ClinearGradient id=\"SVGjvhMwbEq\" x1=\"127.346\" x2=\"125.823\" y1=\"-119.413\" y2=\"-122.265\" gradientTransform=\"matrix(.864 0 0 -.864 -81.843 -81.604)\" href=\"#SVGdWbdmbkP\"\u002F>\u003ClinearGradient id=\"SVGOpHcfeyf\" x1=\"127.349\" x2=\"125.824\" y1=\"-119.279\" y2=\"-122.131\" gradientTransform=\"matrix(.864 0 0 -.864 -81.843 -81.604)\" href=\"#SVG8lm6nc8b\"\u002F>\u003ClinearGradient id=\"SVGy8DX5dGM\" x1=\"127.346\" x2=\"125.823\" y1=\"-115.406\" y2=\"-118.258\" gradientTransform=\"matrix(.864 0 0 -.864 -81.843 -75.452)\" href=\"#SVGdWbdmbkP\"\u002F>\u003ClinearGradient id=\"SVGlg3b5bBd\" x1=\"127.349\" x2=\"125.824\" y1=\"-115.272\" y2=\"-118.125\" gradientTransform=\"matrix(.864 0 0 -.864 -81.843 -75.452)\" href=\"#SVG8lm6nc8b\"\u002F>\u003C\u002Fdefs>\u003Cpath fill=\"#53c1b6\" d=\"M27.5 5.5h-9.3l-2.1 4.2H4.4v16.8h25.2v-21Zm0 4.2h-8.2l1.1-2.1h7.1Z\"\u002F>\u003Cpath fill=\"#00608b\" stroke=\"#000\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"1.28\" d=\"M29.374 12.871a324 324 0 0 1-4.66-1.331a1.3 1.3 0 0 0-.642-.038c-.113.038-6.883 4.008-7.11 4.121c-.038 0-.038.038-.076.076a.8.8 0 0 0-.264.567v0l.078 11.743c0 .189.038.264.189.34c0 0 4.912 1.965 5.479 2.116h.076c.264.038.34.038.453-.076l.038-.038c.113-.076 6.416-4.869 6.529-4.982a.57.57 0 0 0 .151-.3c0-.113.177-11.554.177-11.7v-.038a.51.51 0 0 0-.416-.453Zm-.118.567a2 2 0 0 0 .227-.189s-.113.076-.264.189c-.264.189-.6.416-.982.718c.642-.453 1.209-.831 1.36-.945a2.4 2.4 0 0 1-.336.227Z\"\u002F>\u003Cpath fill=\"#00608b\" d=\"M24.7 11.5a1.3 1.3 0 0 0-.642-.038c-.113.038-6.867 4.051-7.094 4.2c-.189.113-.264.34 0 .453c.264.076 5.214 1.7 5.4 1.738a.82.82 0 0 0 .68-.038c.113-.076 6.516-4.453 6.63-4.566s-.111-.314-.27-.367c-.181-.06-4.518-1.346-4.744-1.422l.038.038Z\"\u002F>\u003Cpath fill=\"#00608b\" d=\"M16.66 16.3c0-.189.113-.3.264-.264c.113.038 5.441 1.776 5.63 1.927c.189.113.3.189.3.34l-.076 11.932a.235.235 0 0 1-.34.227c-.567-.151-5.479-2.116-5.479-2.116c-.151-.076-.189-.151-.189-.34Z\"\u002F>\u003Cpath fill=\"#00608b\" d=\"M22.969 30.389c-.113.076-.235-.013-.235-.226l.046-11.895a.47.47 0 0 1 .189-.378c.113-.076 6.53-4.528 6.681-4.642s.227.113.189.227c0 .113-.214 11.5-.214 11.616a.28.28 0 0 1-.151.264c-.113.113-6.467 4.958-6.543 5.071z\"\u002F>\u003Cpath fill=\"#00608b\" d=\"M16.886 15.963c-.038 0 0-.189.113-.3a.83.83 0 0 0-.34.642a.236.236 0 0 1 .227-.189c.68.227 5.365 1.851 5.554 1.927s.3.144.3.333l.037.451l.068-.459c0-.189.126-.324.352-.475c.113-.076 2.969-2.095 3.775-2.815c-.766.408-3.8 2.777-4.216 2.777c-.321 0-5.831-1.889-5.869-1.889Z\"\u002F>\u003Cpath fill=\"#00608b\" d=\"M26.521 15.4a2 2 0 0 1 .34-.227ZM23 30.365a.46.46 0 0 1-.533.109a.28.28 0 0 0 .281-.226s.029.205.252.118Zm6.58-17.056c.189-.091.269.007.275.169c.027-.167.021-.466-.451-.6c0 0 .379.188.176.428Z\"\u002F>\u003Cpath fill=\"url(#SVGdWbdmbkP)\" d=\"m29.278 23.842l-4.1 2.976v.151l4.091-3.027l.007-.1Z\" opacity=\".13\"\u002F>\u003Cpath fill=\"url(#SVG8lm6nc8b)\" d=\"M29.3 23.719L25.18 26.7v.151l4.1-3.042l.019-.094Z\" opacity=\".13\"\u002F>\u003Cpath fill=\"url(#SVGAPCDfbiV)\" d=\"M18.51 18.444v.227l1.852.642v-.189z\"\u002F>\u003Cpath d=\"m18.51 18.671l-.113.075v-.453l2.04.718l-.075.113l-1.852-.68z\" opacity=\".22\"\u002F>\u003Cpath fill=\"#fff\" d=\"M20.437 19.464v-.453l-.075.113v.189l-1.852-.642l-.113.075z\" opacity=\".72\"\u002F>\u003Cpath fill=\"url(#SVGAxOVFe2Z)\" d=\"m29.278 23.169l-4.1 2.976v.155l4.091-3.027l.007-.1Z\" opacity=\".13\"\u002F>\u003Cpath fill=\"url(#SVGlZ3Pqc9R)\" d=\"m29.3 23.047l-4.12 2.985v.151l4.1-3.042l.019-.094Z\" opacity=\".13\"\u002F>\u003Cpath fill=\"url(#SVGbfvqkd4a)\" d=\"m29.278 22.5l-4.1 2.976v.151l4.093-3.027z\" opacity=\".13\"\u002F>\u003Cpath fill=\"url(#SVG9bgFBcXH)\" d=\"m29.3 22.374l-4.12 2.985v.151l4.1-3.042l.019-.094Z\" opacity=\".13\"\u002F>\u003Cpath fill=\"url(#SVGjvhMwbEq)\" d=\"M29.278 21.824L25.18 24.8v.151l4.091-3.027z\" opacity=\".13\"\u002F>\u003Cpath fill=\"url(#SVGOpHcfeyf)\" d=\"m29.3 21.7l-4.12 2.987v.151l4.1-3.042z\" opacity=\".13\"\u002F>\u003Cpath fill=\"url(#SVGy8DX5dGM)\" d=\"m29.278 24.514l-4.1 2.976v.151l4.091-3.027l.007-.1Z\" opacity=\".13\"\u002F>\u003Cpath fill=\"url(#SVGlg3b5bBd)\" d=\"m29.3 24.392l-4.12 2.985v.151l4.1-3.042l.019-.094Z\" opacity=\".13\"\u002F>",{"left":4,"top":4,"width":20,"height":20,"rotate":4,"vFlip":6,"hFlip":6,"body":27},"\u003Cpath fill=\"#a0bf55\" d=\"M27.5 5.5h-9.3l-2.1 4.2H4.4v16.8h25.2v-21Zm0 4.2h-8.2l1.1-2.1h7.1Z\"\u002F>\u003Cpath fill=\"#fff\" d=\"M27.773 31.076a2.517 2.517 0 0 1-1.848-4.229l-1.67-2.54a4.23 4.23 0 0 1-3.847-.05l-1.662 1.77a2.161 2.161 0 1 1-1.105-.983l1.593-1.7a4.23 4.23 0 0 1-1.1-2.854a4 4 0 0 1 .021-.412l-3.8-1.166a2.517 2.517 0 1 1 .558-1.579c0 .067 0 .134-.009.2l3.646 1.119a4.23 4.23 0 0 1 3.092-2.349v-2.381a2.068 2.068 0 1 1 1.479 0v2.386A4.24 4.24 0 0 1 25.6 17.72l1.928-1.162a2 2 0 0 1-.015-.226a1.807 1.807 0 1 1 1.808 1.808a1.8 1.8 0 0 1-1.023-.319l-1.938 1.171a4.2 4.2 0 0 1 .275 1.5v.036l1.057.183a1.806 1.806 0 1 1-.34 1.443l-.987-.172a4.3 4.3 0 0 1-.91 1.448l1.752 2.67a2.519 2.519 0 1 1 .566 4.973Z\"\u002F>\u003Cpath fill=\"#486600\" d=\"M29.122 20.129a1.68 1.68 0 0 0-1.379.721l-1.24-.215v-.14a4.1 4.1 0 0 0-.306-1.556l2.1-1.267a1.684 1.684 0 1 0-.64-1.05l-2.09 1.261A4.13 4.13 0 0 0 23 16.415v-2.58a1.943 1.943 0 1 0-1.23 0v2.58a4.14 4.14 0 0 0-3.149 2.394l-3.848-1.182a2.395 2.395 0 1 0-.461 1.145l3.979 1.222a4.1 4.1 0 0 0 1.119 3.355l-1.733 1.845a2.04 2.04 0 1 0 .921.816l1.786-1.91a4.11 4.11 0 0 0 3.915.043l1.787 2.717a2.391 2.391 0 1 0 1.066-.616l-1.861-2.83a4.1 4.1 0 0 0 .989-1.573l1.178.2a1.682 1.682 0 1 0 1.665-1.919Z\"\u002F>",{"left":4,"top":4,"width":20,"height":20,"rotate":4,"vFlip":6,"hFlip":6,"body":29},"\u003Cpath fill=\"#ffba58\" d=\"M27.5 5.5h-9.3l-2.1 4.2H4.4v16.8h25.2v-21Zm0 4.2h-8.2l1.1-2.1h7.1Z\"\u002F>\u003Cpath fill=\"#e76a00\" d=\"M20 12.5V14h-4a2.006 2.006 0 0 0-2 2v4h-1.5a2.5 2.5 0 0 0 0 5H14v4a2.006 2.006 0 0 0 2 2h3.8v-1.5a2.7 2.7 0 0 1 5.4 0V31H29a2.006 2.006 0 0 0 2-2v-3.8h-1.5a2.7 2.7 0 0 1 0-5.4H31V16a2.006 2.006 0 0 0-2-2h-4v-1.5a2.5 2.5 0 0 0-5 0\"\u002F>",{"left":4,"top":4,"width":20,"height":20,"rotate":4,"vFlip":6,"hFlip":6,"body":31},"\u003Cpath fill=\"#14622a\" d=\"M27.5 5.5h-9.3l-2.1 4.2H4.4v16.8h25.2v-21Zm0 4.2h-8.2l1.1-2.1h7.1Z\"\u002F>\u003Cpath fill=\"#06cc14\" d=\"M19.146 30.989a1 1 0 0 1-.207-.025a1.04 1.04 0 0 1-.726-1.213l2.709-14.431a1.04 1.04 0 0 1 .444-.683a.9.9 0 0 1 .7-.122a1.043 1.043 0 0 1 .727 1.213L20.077 30.16a1.03 1.03 0 0 1-.442.681a.9.9 0 0 1-.489.148m5.432-2.045h-.068a.93.93 0 0 1-.668-.377a1.1 1.1 0 0 1 .1-1.419l4.658-4.553l-4.638-4.239a1.1 1.1 0 0 1-.141-1.416a.94.94 0 0 1 .661-.4a.9.9 0 0 1 .709.237l5.47 5a1.1 1.1 0 0 1 .144 1.416a1 1 0 0 1-.142.163l-5.447 5.324a.92.92 0 0 1-.638.264m-8.155.003a.9.9 0 0 1-.639-.267l-5.452-5.327a1 1 0 0 1-.132-.153a1.094 1.094 0 0 1 .141-1.414l5.471-5a.88.88 0 0 1 .7-.238a.94.94 0 0 1 .665.4a1.1 1.1 0 0 1-.14 1.417L12.4 22.6l4.659 4.551a1.09 1.09 0 0 1 .1 1.419a.93.93 0 0 1-.669.377Z\"\u002F>",{"left":4,"top":4,"width":20,"height":20,"rotate":4,"vFlip":6,"hFlip":6,"body":33},"\u003Cpath fill=\"#c09553\" d=\"M27.5 5.5h-9.3l-2.1 4.2H4.4v16.8h25.2v-21Zm0 4.2h-8.2l1.1-2.1h7.1Z\"\u002F>",{"left":4,"top":4,"width":20,"height":20,"rotate":4,"vFlip":6,"hFlip":6,"body":35},"\u003Cpath fill=\"#828282\" d=\"M27.5 5.5h-9.3l-2.1 4.2H4.4v16.8h25.2v-21Zm0 4.2h-8.2l1.1-2.1h7.1Z\"\u002F>\u003Cpath fill=\"#333\" d=\"M16.012 10h11.642a3.14 3.14 0 0 1 1.913.817a4.73 4.73 0 0 1 1.363 2.833c.03.212.048.425.07.639v.368a.7.7 0 0 1-.306.491a1.2 1.2 0 0 1-.678.1h-1.637q-.009 6.069 0 12.138a3.57 3.57 0 0 1-.532 1.888A3.63 3.63 0 0 1 25.96 30.8a4.4 4.4 0 0 1-.972.2H13.92a4.04 4.04 0 0 1-2.216-.8a4.48 4.48 0 0 1-1.6-2.7c-.054-.258-.076-.522-.107-.784V26.3a.73.73 0 0 1 .3-.454a1.1 1.1 0 0 1 .639-.1h1.681v-12.14A3.6 3.6 0 0 1 13.744 11a3.64 3.64 0 0 1 2.268-1\"\u002F>\u003Cpath fill=\"gray\" d=\"M14.092 12.777a4.6 4.6 0 0 0-.154 1.653v11.318c2.434.006 4.868 0 7.3 0a.65.65 0 0 1 .587.433a3 3 0 0 1 .051.572a3.42 3.42 0 0 0 1.038 2.278a2.66 2.66 0 0 0 1.806.652a2.3 2.3 0 0 0 2.338-2.252V13.889a2 2 0 0 1 .03-.466a4.6 4.6 0 0 1 .569-1.4a2.2 2.2 0 0 1 .673-.719q-6.051-.008-12.1 0a2.31 2.31 0 0 0-2.138 1.473\"\u002F>\u003Cpath fill=\"#333\" d=\"M18.008 16.819a.7.7 0 0 1 .607-.258a.656.656 0 0 1 .582.722a.2.2 0 0 1-.009.056c-.045.256-.268.415-.437.591c-.638.641-1.293 1.265-1.924 1.912c.654.666 1.327 1.313 1.986 1.974a1.05 1.05 0 0 1 .375.53a.66.66 0 0 1-.466.761a.65.65 0 0 1-.629-.158c-.885-.865-1.757-1.744-2.64-2.611a.665.665 0 0 1-.043-.939v-.006q1.3-1.293 2.598-2.574m3.804.357a.66.66 0 0 1 .574-.609a.67.67 0 0 1 .547.188q1.3 1.285 2.595 2.573a.674.674 0 0 1 .105.947a1 1 0 0 1-.094.1q-1.259 1.244-2.512 2.491a.77.77 0 0 1-.475.277a.656.656 0 0 1-.719-.479a.66.66 0 0 1 .182-.646c.724-.722 1.456-1.434 2.174-2.162c-.711-.713-1.43-1.418-2.146-2.126a.69.69 0 0 1-.231-.554\"\u002F>",{"left":4,"top":4,"width":20,"height":20,"rotate":4,"vFlip":6,"hFlip":6,"body":37},"\u003Cpath fill=\"#5c4300\" d=\"M27.5 5.5h-9.3l-2.1 4.2H4.4v16.8h25.2v-21Zm0 4.2h-8.2l1.1-2.1h7.1Z\"\u002F>\u003Cpath fill=\"#d08b00\" d=\"m23.826 20.454l1.5-1.5a4.34 4.34 0 0 0 3.382-.08a.413.413 0 0 0 .121-.668l-2.679-2.679a.833.833 0 0 1 0-1.179l2.676-2.676a.415.415 0 0 0-.117-.672a4.32 4.32 0 0 0-5.83 5.443l-1.534 1.534Zm-2.874-2.088l-2.079-2.079l-2.481 2.481l2.079 2.079l2.481 2.481l7.6 7.6a.556.556 0 0 0 .786 0l1.695-1.695a.556.556 0 0 0 0-.786l-7.6-7.6Z\"\u002F>\u003Cpath fill=\"#d08b00\" d=\"m29.956 13.068l-2.222 2.222a.455.455 0 0 0 0 .643l1.713 1.713a.454.454 0 0 0 .676-.036a4.33 4.33 0 0 0 .571-4.406a.454.454 0 0 0-.738-.136M12.94 23.6l2.679 2.679a.833.833 0 0 1 0 1.179l-2.676 2.676a.415.415 0 0 0 .122.672a4.32 4.32 0 0 0 5.835-5.427l1.657-1.657l-2.481-2.481l-1.616 1.617a4.34 4.34 0 0 0-3.4.074a.413.413 0 0 0-.12.668\"\u002F>\u003Cpath fill=\"#d08b00\" d=\"M11.651 24.235a4.33 4.33 0 0 0-.571 4.406a.454.454 0 0 0 .737.136l2.222-2.222a.455.455 0 0 0 0-.643L12.327 24.2a.454.454 0 0 0-.676.035m1.272-3.747a.68.68 0 0 0 .963 0l.128-.128a.68.68 0 0 0 0-.963l-.257-.257l.506-.506l-2.376-2.376l-.506.506l-.257-.257a.68.68 0 0 0-.963 0l-.128.128a.68.68 0 0 0 0 .963Zm3.677-8.8l2.347 2.347c2.705-1.8 4.218-.291 2.138-2.37c-1.44-1.439-3.257-.759-4.485.023m-.723.065a.68.68 0 0 0-.963 0l-2.89 2.89a.68.68 0 0 0 0 .963l.257.257l2.376 2.376l.257.257a.68.68 0 0 0 .882.069a1 1 0 0 0 .081-.069l.123-.121l2.481-2.481l.2-.2l.091-.091a.68.68 0 0 0 0-.963l-.28-.28l-2.356-2.356Z\"\u002F>",{"left":4,"top":4,"width":20,"height":20,"rotate":4,"vFlip":6,"hFlip":6,"body":39},"\u003Cpath fill=\"#41b883\" d=\"M24.4 3.925H30l-14 24.15L2 3.925h10.71l3.29 5.6l3.22-5.6Z\"\u002F>\u003Cpath fill=\"#41b883\" d=\"m2 3.925l14 24.15l14-24.15h-5.6L16 18.415L7.53 3.925Z\"\u002F>\u003Cpath fill=\"#35495e\" d=\"M7.53 3.925L16 18.485l8.4-14.56h-5.18L16 9.525l-3.29-5.6Z\"\u002F>",{"left":4,"top":4,"width":20,"height":20,"rotate":4,"vFlip":6,"hFlip":6,"body":41},"\u003Cpath fill=\"#b70b0b\" d=\"M27.5 5.5h-9.3l-2.1 4.2H4.4v16.8h25.2v-21Zm0 4.2h-8.2l1.1-2.1h7.1Z\"\u002F>\u003Cpath fill=\"#fac6c5\" d=\"M28.3 27.423c-1.729-.4-2.332-2.482-1.329-4.583a8.95 8.95 0 0 1 2.217-2.779l.314-.26l.009.357a6.7 6.7 0 0 0 .748 2.425a14 14 0 0 1 .625 1.631a3.2 3.2 0 0 1-.073 1.958a2.67 2.67 0 0 1-1.111 1.087a2.8 2.8 0 0 1-1.4.164m.351-3.565c.124-.143.155-.332.164-1l.011-.825l-.2.158a1.68 1.68 0 0 0-.635 1.4c.07.214.286.448.411.446a.5.5 0 0 0 .249-.179m-15.527 7.087a3.85 3.85 0 0 1-3.031-4.563c.254-1.07.2-1.008 5.726-6.787l5.2-5.442l.738.7l.738.7l-3 3.132l-3 3.132l2.508-.054l2.508-.054l1.773-1.85l1.773-1.85l.735.707l.735.707l-5.213 5.43c-4.783 4.982-5.257 5.452-5.743 5.692a3.9 3.9 0 0 1-2.452.393Zm14.662-12.484c-.138-.082-1.546-1.4-3.129-2.921l-2.879-2.772l-.009-.421a.86.86 0 0 1 .194-.673A.99.99 0 0 1 23 11.3a69 69 0 0 1 6.277 6.023a1 1 0 0 1-1.492 1.133Z\"\u002F>\u003Cpath fill=\"#fac6c5\" d=\"M11.578 26.851a2.1 2.1 0 0 0 2.579 2.614c.191-.2 2.407-2.515 7.387-7.737c-2.505.054-2.475-.055-4.98 0c-5.015 5.195-5.114 5.157-4.986 5.123\"\u002F>",{"left":4,"top":4,"width":20,"height":20,"rotate":4,"vFlip":6,"hFlip":6,"body":43},"\u003Cg fill-rule=\"evenodd\">\u003Cpath d=\"M3.167 3.167h25.667v25.667H3.167z\"\u002F>\u003Cpath fill=\"#ecd53f\" fill-rule=\"nonzero\" d=\"M30 2v28H2V2zM14.757 20.539H9.98v6.44h4.898v-1.085h-3.597V24.14h3.232v-1.085H11.28v-1.428h3.475v-1.09zm2.503 0h-1.264v6.44h1.207v-4.2l2.597 4.2h1.305v-6.44h-1.21v4.3zm5.97 0h-1.41l2.303 6.44h1.388l2.306-6.44h-1.38l-1.577 4.766l-1.63-4.767zM8.3 24.96H6.34v1.96H8.3z\"\u002F>\u003C\u002Fg>",{"left":4,"top":4,"width":20,"height":20,"rotate":4,"vFlip":6,"hFlip":6,"body":45},"\u003Cpath fill=\"#007acc\" d=\"M23.827 8.243a4.4 4.4 0 0 1 2.223 1.281a6 6 0 0 1 .852 1.143c.011.045-1.534 1.083-2.471 1.662c-.034.023-.169-.124-.322-.35a2.01 2.01 0 0 0-1.67-1c-1.077-.074-1.771.49-1.766 1.433a1.3 1.3 0 0 0 .153.666c.237.49.677.784 2.059 1.383c2.544 1.095 3.636 1.817 4.31 2.843a5.16 5.16 0 0 1 .416 4.333a4.76 4.76 0 0 1-3.932 2.815a11 11 0 0 1-2.708-.028a6.53 6.53 0 0 1-3.616-1.884a6.3 6.3 0 0 1-.926-1.371a3 3 0 0 1 .327-.208c.158-.09.756-.434 1.32-.761l1.024-.6l.214.312a4.8 4.8 0 0 0 1.35 1.292a3.3 3.3 0 0 0 3.458-.175a1.545 1.545 0 0 0 .2-1.974c-.276-.395-.84-.727-2.443-1.422a8.8 8.8 0 0 1-3.349-2.055a4.7 4.7 0 0 1-.976-1.777a7.1 7.1 0 0 1-.062-2.268a4.33 4.33 0 0 1 3.644-3.374a9 9 0 0 1 2.691.084m-8.343 1.483l.011 1.454h-4.63v13.148H7.6V11.183H2.97V9.755a14 14 0 0 1 .04-1.466c.017-.023 2.832-.034 6.245-.028l6.211.017Z\"\u002F>",{"left":4,"top":4,"width":20,"height":20,"rotate":4,"vFlip":6,"hFlip":6,"body":47},"\u003Cpath fill=\"#f5de19\" d=\"M4.014 14.976a2.5 2.5 0 0 0 1.567-.518a2.38 2.38 0 0 0 .805-1.358a15.3 15.3 0 0 0 .214-2.944q.012-2.085.075-2.747a5.2 5.2 0 0 1 .418-1.686a3 3 0 0 1 .755-1.018A3.05 3.05 0 0 1 9 4.125A6.8 6.8 0 0 1 10.544 4h.7v1.96h-.387a2.34 2.34 0 0 0-1.723.468a3.4 3.4 0 0 0-.425 2.092a36 36 0 0 1-.137 4.133a4.7 4.7 0 0 1-.768 2.06A4.6 4.6 0 0 1 6.1 16a3.8 3.8 0 0 1 1.992 1.754a8.9 8.9 0 0 1 .618 3.865q0 2.435.05 2.9a1.76 1.76 0 0 0 .504 1.181a2.64 2.64 0 0 0 1.592.337h.387V28h-.7a5.7 5.7 0 0 1-1.773-.2a2.97 2.97 0 0 1-1.324-.93a3.35 3.35 0 0 1-.681-1.63a24 24 0 0 1-.165-3.234a16.5 16.5 0 0 0-.214-3.106a2.4 2.4 0 0 0-.805-1.361a2.5 2.5 0 0 0-1.567-.524Zm23.972 2.035a2.5 2.5 0 0 0-1.567.524a2.4 2.4 0 0 0-.805 1.361a16.5 16.5 0 0 0-.212 3.109a24 24 0 0 1-.169 3.234a3.35 3.35 0 0 1-.681 1.63a2.97 2.97 0 0 1-1.324.93a5.7 5.7 0 0 1-1.773.2h-.7V26.04h.387a2.64 2.64 0 0 0 1.592-.337a1.76 1.76 0 0 0 .506-1.186q.05-.462.05-2.9a8.9 8.9 0 0 1 .618-3.865A3.8 3.8 0 0 1 25.9 16a4.6 4.6 0 0 1-1.7-1.286a4.7 4.7 0 0 1-.768-2.06a36 36 0 0 1-.137-4.133a3.4 3.4 0 0 0-.425-2.092a2.34 2.34 0 0 0-1.723-.468h-.387V4h.7a6.8 6.8 0 0 1 1.54.125a3.05 3.05 0 0 1 1.149.581a3 3 0 0 1 .755 1.018a5.2 5.2 0 0 1 .418 1.686q.062.662.075 2.747a15.3 15.3 0 0 0 .212 2.947a2.38 2.38 0 0 0 .805 1.355a2.5 2.5 0 0 0 1.567.518Z\"\u002F>",{"id":49,"title":50,"body":51,"description":848,"extension":849,"meta":850,"navigation":10,"path":851,"seo":852,"stem":853,"__hash__":854},"docs\u002Fdocs\u002Fv2\u002Fconcepts\u002Fkernel-and-policy.md","Kernel & Policy",{"type":52,"value":53,"toc":840},"minimark",[54,58,71,83,86,91,99,117,139,146,209,212,227,231,238,556,559,565,590,594,597,674,677,681,688,752,755,760,763,767,770,774,777,781,786,808,813,828,836],[55,56,50],"h1",{"id":57},"kernel-policy",[59,60,61,62,66,67,70],"p",{},"An agent runs as its own OS process, and everything it does happens inside that one\nbox. The ",[63,64,65],"strong",{},"kernel"," — the trusted core of the runtime — owns the machine-facing\noperations. Agent code runs in the ",[63,68,69],{},"capsule",", the mediated scope inside the same\nprocess: every tool call and every model-emitted block passes through the kernel, which\nchecks it against your policy before anything executes.",[59,72,73,74,78,79,82],{},"That is the security model in one sentence: the capsule can ",[75,76,77],"em",{},"request","; only the kernel\ncan ",[75,80,81],{},"take",". The model is treated as untrusted — full stop.",[59,84,85],{},"Most \"agent security\" is a system prompt asking the model to behave — instructions it\ncan ignore, forget, or be talked out of. Axon's is not. Your policy is enforced by the\nruntime on every platform, and on Linux by the operating system itself. The model can\nwant whatever it wants; the privileges are not there.",[87,88,90],"h2",{"id":89},"two-layers-one-policy","Two layers, one policy",[59,92,93,94,98],{},"The same ",[95,96,97],"code",{},"policy"," block drives both. They differ in what they can express and how\nabsolutely they hold.",[59,100,101,104,105,108,109,112,113,116],{},[63,102,103],{},"The mediator"," runs everywhere. It gates every declared tool call and every\n",[95,106,107],{},"process.run","\u002F",[95,110,111],{},"process.spawn"," by glob, returning typed denials, raising escalations, and\nemitting a span for each decision. It is the layer that can ",[75,114,115],{},"ask you"," — an OS wall\ncannot pause and request approval.",[59,118,119,122,123,126,127,130,131,134,135,138],{},[63,120,121],{},"OS confinement"," runs on Linux, and it is the wall. ",[95,124,125],{},"fs"," becomes mount-namespace bind\nmounts, so a path you did not grant does not exist inside the box — a forbidden read\nfails as \"no such file\", not \"permission denied\". ",[95,128,129],{},"net"," becomes a network namespace with\na default-drop nftables ruleset, so a raw socket to an ungranted address is dropped by the\nkernel rather than by a check in front of it. ",[95,132,133],{},"limits"," becomes cgroup caps. ",[95,136,137],{},"env"," becomes\nan environment built from nothing rather than inherited. Where the two overlap, the OS\nlayer is the truth and the mediator is the polite error in front of it.",[59,140,141,142,145],{},"The box wraps the ",[63,143,144],{},"whole agent process and everything it spawns",":",[147,148,153],"pre",{"className":149,"code":150,"language":151,"meta":152,"style":152},"language-bash shiki shiki-themes dark-plus","systemd-run --scope \u003Climits> -- bwrap \u003Cbox> -- bun run \u003Cagent>\n","bash","",[95,154,155],{"__ignoreMap":152},[156,157,160,164,168,172,176,179,182,185,187,190,193,195,198,201,203,206],"span",{"class":158,"line":159},"line",1,[156,161,163],{"class":162},"sCudf","systemd-run",[156,165,167],{"class":166},"scz_3"," --scope",[156,169,171],{"class":170},"sTNBD"," \u003C",[156,173,175],{"class":174},"sKc5r","limit",[156,177,178],{"class":170},"s> ",[156,180,181],{"class":166},"--",[156,183,184],{"class":174}," bwrap",[156,186,171],{"class":170},[156,188,189],{"class":174},"bo",[156,191,192],{"class":170},"x> ",[156,194,181],{"class":166},[156,196,197],{"class":174}," bun",[156,199,200],{"class":174}," run",[156,202,171],{"class":170},[156,204,205],{"class":174},"agen",[156,207,208],{"class":170},"t>\n",[59,210,211],{},"The cgroup is outermost, so resource limits cover the process tree — a subprocess cannot\nmultiply the budget by spawning helpers. Bubblewrap holds the filesystem, pid and network\nisolation.",[59,213,214,215,217,218,220,221,223,224,226],{},"macOS and Windows get the mediator only; the namespaces do not exist there, so ",[95,216,125],{},",\n",[95,219,129],{},", ",[95,222,137],{}," and ",[95,225,133],{}," are unenforced. That is a real reduction rather than a\nformality. If you want the full posture, run on Linux — your cloud deployment already\ndoes.",[87,228,230],{"id":229},"policy-is-what-you-tell-the-kernel-to-allow","Policy is what you tell the kernel to allow",[59,232,233,234,237],{},"Declared once in ",[95,235,236],{},"axon.config.ts",". The kernel applies it at every enforcement layer\navailable on the host system.",[147,239,243],{"className":240,"code":241,"language":242,"meta":152,"style":152},"language-ts shiki shiki-themes dark-plus","export default defineAgent({\n    policy: {\n        isolation: \"auto\",\n        fs: {\n            read:  [\".\u002Fsrc\", \".\u002Fpackage.json\"],\n            write: [\".\u002Foutput\"],\n        },\n        net: {\n            allow: [\"api.github.com:443\"],\n            dns:   \"allowlist\",\n        },\n        shell: {\n            allow: [\"git\", \"bun\"],\n            args:  { git: { deny: [\"push --force*\"] } },\n            raw:   false,\n            spawn: false,\n        },\n        env: { allow: [\"GITHUB_TOKEN\"] },\n        tools: {\n            fs: { read: true, remove: false },\n            \"*\": \"escalate\",\n        },\n        limits: { memory: \"2G\", cpu: \"100%\", wall: \"30m\" },\n    },\n})\n","ts",[95,244,245,260,270,281,289,309,323,329,337,350,361,366,374,391,417,428,439,444,463,471,495,508,513,545,550],{"__ignoreMap":152},[156,246,247,251,254,257],{"class":158,"line":159},[156,248,250],{"class":249},"sYbnZ","export",[156,252,253],{"class":249}," default",[156,255,256],{"class":162}," defineAgent",[156,258,259],{"class":170},"({\n",[156,261,263,267],{"class":158,"line":262},2,[156,264,266],{"class":265},"s3F5K","    policy:",[156,268,269],{"class":170}," {\n",[156,271,273,276,279],{"class":158,"line":272},3,[156,274,275],{"class":265},"        isolation:",[156,277,278],{"class":174}," \"auto\"",[156,280,217],{"class":170},[156,282,284,287],{"class":158,"line":283},4,[156,285,286],{"class":265},"        fs:",[156,288,269],{"class":170},[156,290,292,295,298,301,303,306],{"class":158,"line":291},5,[156,293,294],{"class":265},"            read:",[156,296,297],{"class":170},"  [",[156,299,300],{"class":174},"\".\u002Fsrc\"",[156,302,220],{"class":170},[156,304,305],{"class":174},"\".\u002Fpackage.json\"",[156,307,308],{"class":170},"],\n",[156,310,312,315,318,321],{"class":158,"line":311},6,[156,313,314],{"class":265},"            write:",[156,316,317],{"class":170}," [",[156,319,320],{"class":174},"\".\u002Foutput\"",[156,322,308],{"class":170},[156,324,326],{"class":158,"line":325},7,[156,327,328],{"class":170},"        },\n",[156,330,332,335],{"class":158,"line":331},8,[156,333,334],{"class":265},"        net:",[156,336,269],{"class":170},[156,338,340,343,345,348],{"class":158,"line":339},9,[156,341,342],{"class":265},"            allow:",[156,344,317],{"class":170},[156,346,347],{"class":174},"\"api.github.com:443\"",[156,349,308],{"class":170},[156,351,353,356,359],{"class":158,"line":352},10,[156,354,355],{"class":265},"            dns:",[156,357,358],{"class":174},"   \"allowlist\"",[156,360,217],{"class":170},[156,362,364],{"class":158,"line":363},11,[156,365,328],{"class":170},[156,367,369,372],{"class":158,"line":368},12,[156,370,371],{"class":265},"        shell:",[156,373,269],{"class":170},[156,375,377,379,381,384,386,389],{"class":158,"line":376},13,[156,378,342],{"class":265},[156,380,317],{"class":170},[156,382,383],{"class":174},"\"git\"",[156,385,220],{"class":170},[156,387,388],{"class":174},"\"bun\"",[156,390,308],{"class":170},[156,392,394,397,400,403,406,409,411,414],{"class":158,"line":393},14,[156,395,396],{"class":265},"            args:",[156,398,399],{"class":170},"  { ",[156,401,402],{"class":265},"git:",[156,404,405],{"class":170}," { ",[156,407,408],{"class":265},"deny:",[156,410,317],{"class":170},[156,412,413],{"class":174},"\"push --force*\"",[156,415,416],{"class":170},"] } },\n",[156,418,420,423,426],{"class":158,"line":419},15,[156,421,422],{"class":265},"            raw:",[156,424,425],{"class":166},"   false",[156,427,217],{"class":170},[156,429,431,434,437],{"class":158,"line":430},16,[156,432,433],{"class":265},"            spawn:",[156,435,436],{"class":166}," false",[156,438,217],{"class":170},[156,440,442],{"class":158,"line":441},17,[156,443,328],{"class":170},[156,445,447,450,452,455,457,460],{"class":158,"line":446},18,[156,448,449],{"class":265},"        env:",[156,451,405],{"class":170},[156,453,454],{"class":265},"allow:",[156,456,317],{"class":170},[156,458,459],{"class":174},"\"GITHUB_TOKEN\"",[156,461,462],{"class":170},"] },\n",[156,464,466,469],{"class":158,"line":465},19,[156,467,468],{"class":265},"        tools:",[156,470,269],{"class":170},[156,472,474,477,479,482,485,487,490,492],{"class":158,"line":473},20,[156,475,476],{"class":265},"            fs:",[156,478,405],{"class":170},[156,480,481],{"class":265},"read:",[156,483,484],{"class":166}," true",[156,486,220],{"class":170},[156,488,489],{"class":265},"remove:",[156,491,436],{"class":166},[156,493,494],{"class":170}," },\n",[156,496,498,501,503,506],{"class":158,"line":497},21,[156,499,500],{"class":174},"            \"*\"",[156,502,145],{"class":265},[156,504,505],{"class":174}," \"escalate\"",[156,507,217],{"class":170},[156,509,511],{"class":158,"line":510},22,[156,512,328],{"class":170},[156,514,516,519,521,524,527,529,532,535,537,540,543],{"class":158,"line":515},23,[156,517,518],{"class":265},"        limits:",[156,520,405],{"class":170},[156,522,523],{"class":265},"memory:",[156,525,526],{"class":174}," \"2G\"",[156,528,220],{"class":170},[156,530,531],{"class":265},"cpu:",[156,533,534],{"class":174}," \"100%\"",[156,536,220],{"class":170},[156,538,539],{"class":265},"wall:",[156,541,542],{"class":174}," \"30m\"",[156,544,494],{"class":170},[156,546,547],{"class":158,"line":5},[156,548,549],{"class":170},"    },\n",[156,551,553],{"class":158,"line":552},25,[156,554,555],{"class":170},"})\n",[59,557,558],{},"A call that violates policy is rejected before the function runs. The agent receives a\nstructured error and adapts from there.",[59,560,561,564],{},[63,562,563],{},"No policy block means unrestricted access, not denied access."," That is deliberate for\nlocal development: an agent on your own machine, with no policy, is a personal tool with\nyour privileges. For anything deployed or published, declare explicit rules.",[59,566,567,568,220,570,220,572,574,575,577,578,581,582,585,586,589],{},"Setting any ",[95,569,125],{},[95,571,129],{},[95,573,137],{}," or ",[95,576,133],{}," rule turns the OS box on by default —\n",[95,579,580],{},"isolation"," becomes ",[95,583,584],{},"\"auto\""," rather than ",[95,587,588],{},"\"none\"",". You rarely set it by hand.",[87,591,593],{"id":592},"per-invocation-narrowing","Per-invocation narrowing",[59,595,596],{},"The base policy applies to every invocation. Individual calls can narrow it further —\nthe standard move for routes handling untrusted input:",[147,598,600],{"className":240,"code":599,"language":242,"meta":152,"style":152},"const result = await axon.request({\n    prompt,\n    policy: {\n        fs:    { read: [], write: [] },\n        shell: false,\n    },\n})\n",[95,601,602,627,634,640,658,666,670],{"__ignoreMap":152},[156,603,604,607,611,614,617,620,623,625],{"class":158,"line":159},[156,605,606],{"class":166},"const",[156,608,610],{"class":609},"s9McN"," result",[156,612,613],{"class":170}," = ",[156,615,616],{"class":249},"await",[156,618,619],{"class":265}," axon",[156,621,622],{"class":170},".",[156,624,77],{"class":162},[156,626,259],{"class":170},[156,628,629,632],{"class":158,"line":262},[156,630,631],{"class":265},"    prompt",[156,633,217],{"class":170},[156,635,636,638],{"class":158,"line":272},[156,637,266],{"class":265},[156,639,269],{"class":170},[156,641,642,644,647,649,652,655],{"class":158,"line":283},[156,643,286],{"class":265},[156,645,646],{"class":170},"    { ",[156,648,481],{"class":265},[156,650,651],{"class":170}," [], ",[156,653,654],{"class":265},"write:",[156,656,657],{"class":170}," [] },\n",[156,659,660,662,664],{"class":158,"line":291},[156,661,371],{"class":265},[156,663,436],{"class":166},[156,665,217],{"class":170},[156,667,668],{"class":158,"line":311},[156,669,549],{"class":170},[156,671,672],{"class":158,"line":325},[156,673,555],{"class":170},[59,675,676],{},"Narrowing can only restrict. A call can never grant access beyond the base policy, and\nthe narrowed policy clears when the invocation completes.",[87,678,680],{"id":679},"escalation","Escalation",[59,682,683,684,687],{},"For calls that need a human decision, ",[95,685,686],{},"escalate"," pauses execution and surfaces the call:",[147,689,691],{"className":240,"code":690,"language":242,"meta":152,"style":152},"policy: {\n    shell: {\n        allow: [\"git\"],\n        args:  { git: { escalate: [\"push*\"] } },\n    },\n}\n",[95,692,693,701,708,720,743,747],{"__ignoreMap":152},[156,694,695,698],{"class":158,"line":159},[156,696,97],{"class":697},"sqDPy",[156,699,700],{"class":170},": {\n",[156,702,703,706],{"class":158,"line":262},[156,704,705],{"class":697},"    shell",[156,707,700],{"class":170},[156,709,710,713,716,718],{"class":158,"line":272},[156,711,712],{"class":697},"        allow",[156,714,715],{"class":170},": [",[156,717,383],{"class":174},[156,719,308],{"class":170},[156,721,722,725,728,731,734,736,738,741],{"class":158,"line":283},[156,723,724],{"class":697},"        args",[156,726,727],{"class":170},":  { ",[156,729,730],{"class":697},"git",[156,732,733],{"class":170},": { ",[156,735,686],{"class":697},[156,737,715],{"class":170},[156,739,740],{"class":174},"\"push*\"",[156,742,416],{"class":170},[156,744,745],{"class":158,"line":291},[156,746,549],{"class":170},[156,748,749],{"class":158,"line":311},[156,750,751],{"class":170},"}\n",[59,753,754],{},"The TUI shows the call, the arguments it was made with, and waits:",[756,757],"terminal-image",{"alt":758,"src":759},"The terminal suspended on a search.web call, showing the query and three choices: allow once, allow always, and deny","\u002Ftui\u002Fpolicy-escalation-prompt.webp",[59,761,762],{},"Approving once settles this call; approving always writes a grant so the same call stops\nasking. Headless, with no TUI attached, an unresolved escalation fails closed after the\ntimeout (default 30 seconds).",[87,764,766],{"id":765},"what-the-agent-sees","What the agent sees",[59,768,769],{},"A blocked call comes back as a structured policy error — the agent doesn't see the\nrules themselves. A well-written agent explains what it tried and either takes another\napproach or tells you it needs broader access.",[756,771],{"alt":772,"src":773},"A denied call shown inline as CAPSULE_POLICY_DENIED: search.web denied by policy, followed by the agent explaining it cannot reach live web results and asking how else it can help","\u002Ftui\u002Fpolicy-denied.webp",[59,775,776],{},"The denial is an ordinary error the agent reasons about, not a crash — which is why the\nconversation continues rather than ending on a stack trace.",[87,778,780],{"id":779},"what-this-does-and-does-not-protect-against","What this does and does not protect against",[59,782,783],{},[63,784,785],{},"Protects against:",[787,788,789,793,796,799],"ul",{},[790,791,792],"li",{},"Agent-emitted code touching the filesystem, network, environment, or shell outside\ndeclared policy",[790,794,795],{},"Per-invocation policy violations in routes handling untrusted input",[790,797,798],{},"Runaway resource use — cgroup caps cover the process tree, so spawning helpers cannot\nmultiply the budget",[790,800,801,802,804,805,807],{},"On Linux: even a mediator bypass hits the OS wall. A path outside ",[95,803,125],{}," does not exist\ninside the box, and a host outside ",[95,806,129],{}," is unreachable at the namespace level",[59,809,810],{},[63,811,812],{},"Does not protect against:",[787,814,815,818,825],{},[790,816,817],{},"A tool with legitimate network access exfiltrating data through an allowed endpoint.\nPolicy gates which destinations can be reached, not what flows through them.",[790,819,820,821,824],{},"A tool crashing the agent. Tools run in the agent's own process, so a tool that calls\n",[95,822,823],{},"process.exit()"," ends the agent — the blast radius is one agent and one conversation,\nand the supervisor records it, but the process does go.",[790,826,827],{},"Deliberate exploitation of the runtime itself. Trust your tool implementations.",[59,829,830,831,622],{},"For the full policy field reference, see ",[832,833,835],"a",{"href":834},"\u002Fdocs\u002Fv2\u002Fagent\u002Fpolicy","Policy",[837,838,839],"style",{},"html pre.shiki code .sCudf, html code.shiki .sCudf{--shiki-default:#DCDCAA}html pre.shiki code .scz_3, html code.shiki .scz_3{--shiki-default:#569CD6}html pre.shiki code .sTNBD, html code.shiki .sTNBD{--shiki-default:#D4D4D4}html pre.shiki code .sKc5r, html code.shiki .sKc5r{--shiki-default:#CE9178}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html pre.shiki code .sYbnZ, html code.shiki .sYbnZ{--shiki-default:#C586C0}html pre.shiki code .s3F5K, html code.shiki .s3F5K{--shiki-default:#9CDCFE}html pre.shiki code .s9McN, html code.shiki .s9McN{--shiki-default:#4FC1FF}html pre.shiki code .sqDPy, html code.shiki .sqDPy{--shiki-default:#C8C8C8}",{"title":152,"searchDepth":262,"depth":262,"links":841},[842,843,844,845,846,847],{"id":89,"depth":262,"text":90},{"id":229,"depth":262,"text":230},{"id":592,"depth":262,"text":593},{"id":679,"depth":262,"text":680},{"id":765,"depth":262,"text":766},{"id":779,"depth":262,"text":780},"An agent runs as its own OS process. The kernel owns machine-facing operations; agent code runs in the mediated capsule inside that box.","md",{},"\u002Fdocs\u002Fv2\u002Fconcepts\u002Fkernel-and-policy",{"title":50,"description":848},"docs\u002Fv2\u002Fconcepts\u002Fkernel-and-policy","ZMSkQcM4wS4AlG_QMMm3NbTPTlj65wbmIykz9OBvtD8",1788121884350]