Politiques et garde-fous

POLICY {
    DEFAULT DENY

    ALLOW inspect_endpoint
    ALLOW isolate_endpoint IF P(credential_attack) >= 0.95

    NEVER isolate_endpoint
        WHEN asset.criticality == CRITICAL

    REQUIRE APPROVAL FOR isolate_endpoint
        WHEN action.risk >= HIGH
}

POLICY {
    NEVER wipe_host WHEN UNTRUSTED(host) AND NOT ATTESTED(host, check_wipeable)
    NEVER transfer  WHEN LLM_DERIVED(to) AND NOT ATTESTED(to, resolve_account)
    NEVER transfer  WHEN tools.transfer.in_doubt == true
}