Table of Contents
🌏 中文版
The tool-executor article covered mechanical path, argv, environment, and timeout limits. This is one coding-agent security boundary; permission policy answers a different question: who authorizes a schema-valid operation?
Denies win across all sources
Rivumi merges permission sources in a fixed order:
critical command floor
user deny → organization deny → project deny
user allow → organization allow → project allow
otherwise follow approval modeA project allow does not override a user deny. All deny rules are evaluated before all allow rules; source ordering primarily preserves diagnostic provenance. Rules can target a tool, a prefix under a tool, or an exact value, and malformed rules are rejected.
Execute requests receive command classification
classify_command_policy() denies blank commands, denies critical patterns, asks for suspicious patterns, and denies suspicious commands paired with an excessive timeout. Other commands may proceed. The critical floor runs before reused session grants or an interactive prompt.
This is a bounded lexical classifier, not a complete shell parser. It handles known high-risk shapes but cannot prove arbitrary shell composition safe. Native run_check also has a separate exact-argv allowlist.
Approvals have explicit lifetime
An approval request represents exactly one tool call or command. Decisions are allow once, allow for session, deny, or cancel. Session grants remain scoped to the current session, and an interrupted approval is abandoned and fails closed. Headless execution must resolve policy without pretending an interactive user approved it.
Dangerous mode auto-allows read and modify effects only. Execute still passes through classification, rules, and approval mode; dangerous root execution is refused without a sandbox. The result is an authority decision, not filesystem, process, or network containment. That enforcement belongs to the local OS sandbox layer.
References
Loading...