YAML Policy Template for Code Assistants

Code assistant agents operate with significant power: they read files, write code, execute commands, and interact with version control. Their policies must prevent damage to the broader system while allowing productive development workflows.

version: "1.0"
name: "code-assistant-policy"
description: "Policy for AI coding assistants"

defaults:
  action: deny
  log: true
  notify: false

rules:
  # Allow reading files within the project directory
  - name: "allow-project-reads"
    match:
      tool: "read_file"
      parameters:
        path:
          pattern: "^/workspace/project/"
    action: allow

  # Allow writing files within the project directory
  - name: "allow-project-writes"
    match:
      tool: "write_file"
      parameters:
        path:
          pattern: "^/workspace/project/"
          not_pattern: "\\.(env|pem|key)$"
    action: allow

  # Block reading sensitive files
  - name: "block-sensitive-reads"
    match:
      tool: "read_file"
      parameters:
        path:
          pattern: "(\\.env|\\.ssh|credentials|secrets)"
    action: deny

  # Allow running tests
  - name: "allow-test-execution"
    match:
      tool: "execute_command"
      parameters:
        command:
          pattern: "^(npm test|pnpm test|vitest|jest|pytest)"
    action: allow

  # Allow linting and formatting
  - name: "allow-lint-format"
    match:
      tool: "execute_command"
      parameters:
        command:
          pattern: "^(eslint|prettier|biome)"
    action: allow

  # Allow git read operations
  - name: "allow-git-reads"
    match:
      tool: "execute_command"
      parameters:
        command:
          pattern: "^git (status|diff|log|show|branch)"
    action: allow

  # Require approval for git write operations
  - name: "approve-git-writes"
    match:
      tool: "execute_command"
      parameters:
        command:
          pattern: "^git (commit|push|merge|rebase)"
    action: approve
    approval:
      timeout: 300
      approvers: ["developer"]

  # Block destructive commands
  - name: "block-destructive-commands"
    match:
      tool: "execute_command"
      parameters:
        command:
          pattern: "(rm -rf|sudo|chmod 777|curl.*\\|.*sh)"
    action: deny

  # Block network access
  - name: "block-network-commands"
    match:
      tool: "execute_command"
      parameters:
        command:
          pattern: "^(curl|wget|nc|ssh)"
    action: deny

Key constraints in this template:

Path boundaries. File operations are restricted to the project directory. The agent cannot read or write outside its workspace.

Secret protection. Files matching common secret patterns (.env, .pem, .key, credentials) are blocked from both reading and writing.

Command allowlisting. Only specific command categories are permitted: tests, linting, and git reads. Everything else is denied or requires approval.

Git write approval. The agent can inspect the repository freely but needs developer approval to commit, push, or modify history.