201 tokens

Policy

Required host actions and resources.

Policy

packages declare required host actions and resources in policy.requires
applications and workspaces decide access with ordered policy.rules
each rule matches a subject such as a package, an action such as fs.read or net.connect, and a resource pattern
bindings are the runtime enforcement point because every host interaction crosses a typed @binding

1{2    "policy": {3        "requires": [4            { "action": "fs.read", "resource": "app://config/**" },5            { "action": "net.connect", "resource": "tcp://database.internal:5432" }6        ],7        "rules": [8            {9                "subject": { "package": "@vendor/parser" },10                "action": "net.connect",11                "resource": "*",12                "access": "deny"13            }14        ]15    }16}