Command policy

Allow selected commands #

Start the laptop agent with either --config FILE or --allow-all. A config defaults to denying unlisted commands, SSH keys, and management operations. --allow-all permits any executable, SSH key, and supported management operation while keeping approval for each request.

examples/policy.json allows op read with biometric approval and gh pr view with a confirmation prompt. It includes rules for SSH authentication, Git signing, adding or removing the selected key, and locking or unlocking the agent. Copy it to a local policy file, set the executable paths for your laptop, and replace the key fingerprint. Inspect executable paths with command -v op and command -v gh, and list fingerprints with lend keys while SSH_AUTH_SOCK points at the original agent.

 1{
 2  "default": "deny",
 3  "require_reason": true,
 4  "commands": [
 5    {
 6      "executable": "/opt/homebrew/bin/op",
 7      "args_prefix": ["read"],
 8      "approval": "biometric"
 9    },
10    {
11      "executable": "/opt/homebrew/bin/gh",
12      "args_prefix": ["pr", "view"],
13      "approval": "prompt"
14    }
15  ],
16  "ssh": {
17    "default": "deny",
18    "keys": [
19      {
20        "fingerprint": "SHA256:REPLACE_WITH_FINGERPRINT_FROM_LEND_KEYS",
21        "label": "SSH login and Git signing",
22        "approval": "biometric",
23        "purposes": ["ssh", "sshsig"],
24        "namespaces": ["git"],
25        "max_signatures": 10
26      }
27    ]
28  }
29}

Executable paths are absolute and resolved through symlinks when loading the policy and when receiving a request. Prefixes match complete arguments: ["pr", "view"] allows further arguments after those two. The longest matching prefix determines approval. An omitted prefix permits every argument to that executable. Duplicate rules and unknown config fields are rejected. Policy changes take effect after restarting the agent.

authenticate and biometric requests fail on Linux, in macOS builds without cgo, and when using --approval=terminal. A biometric request also fails when biometry is unavailable, unenrolled, or locked out. The remote caller cannot select a weaker approval requirement. Every command needs local approval or an explicitly approved lease for its scope.

Set "default": "allow" and "default_approval": "biometric" to permit every command with biometric approval. require_reason requires a nonempty requester-supplied reason for both CLI and MCP calls. Reasons are displayed as untrusted text and do not establish identity or change policy.

Argument prefixes control which command requests are admitted. They do not restrict the capabilities of an approved executable. Further arguments, configuration files, plugins, and stdin can affect what it does. Every admitted request still receives its required approval.