Everything the engine enforces, and everything it leaves to you.

01 / Decisions

Set the policy. Watch what happens to a tool call.

Rules are evaluated in order and the first match decides. Change the mode and the toggles: every verdict below is recomputed from the same rules the engine applies.

{
  "timestamp": 1714000000000,
  "tool": "Bash",
  "input": { "command": "rm -rf /tmp/build" },
  "decision": "ask",
  "reason": "dangerous pattern, operator prompted",
  "rule": "",
  "sessionID": "sess_abc123"
}

Rules and dangerous patterns are separate systems. Rules are checked first; an explicit allow runs the command without dangerous-pattern review. Read the source: permissions.md, dangerous-patterns.md, audit.md.

02 / Boundary

Where your infrastructure ends.

Three kinds of traffic leave the host. Turn one on to see where it goes and what makes it go. The map names possible flows instead of claiming a single egress path.

Provider traffic, tool and identity traffic, and log export. Host network policy remains the operator control for all three.

Enterprise network configuration replaces lower-layer network settings entirely, and a sealed rejectUnauthorized: true cannot be turned off below it. Source: enterprise/network.md.

03 / Controls

Showing 8 of 8 controls. Sealable means enterprise configuration can set the value and prevent a lower layer from weakening it.

04 / Enforcement

One tool call, eight stages.

Every tool call passes through all eight, in this order. Pick one to see what it does and what it cannot do.

05 / Configuration

The files that carry the policy.

The permission policy, the audit entry it produces, the enterprise config that seals it, and the network settings that govern outbound traffic.

{
  "permissions": {
    "mode": "ask",
    "rules": [
      { "tool": "Read", "decision": "allow" },
      { "tool": "Bash", "decision": "allow", "commandPatterns": ["^git\\s"] },
      { "tool": "Bash", "decision": "deny",  "commandPatterns": ["rm\\s+-rf"] },
      { "tool": "Write", "decision": "deny", "pathPatterns": ["/etc/*", "/usr/*"] }
    ],
    "dangerousPatterns": ["(?i)drop\\s+database", "terraform\\s+destroy"],
    "readOnlyPaths": ["/etc/**", "/usr/**", "node_modules/**"]
  },
  "security": { "redactSecrets": true },
  "sandbox": { "enabled": true }
}

How enterprise config seals a value

Enterprise configuration is not another layer in the merge. It is a constraint applied after defaults, user and project have merged, and it only ever removes. That ordering is what makes the permissive merge below it safe.

The final config is immutable for the session lifetime. Source: enterprise/sealed-config.md.

06 / Credentials

Extension code never holds a token.

For a service behind an identity provider, the engine brokers the token. It holds the identity, mints a short-lived token scoped to exactly what the code asked for, and sets the authorization header itself. An authorization header an extension tries to set is overwritten. Calls to private and reserved addresses are rejected by default; an extension that needs an intranet API opts out per request, and that opt-out is an operator decision, visible in source.

const res = await ctx.http.get('https://graph.microsoft.com/v1.0/me', {
  scope: 'https://graph.microsoft.com/User.Read',
})

07 / Limits

Who is responsible for what.

Report vulnerabilities through GitHub Security Advisories. Policy: SECURITY.md.

08 / Evidence

Evidence for review.

• Security policy

  SECURITY.md

• Security model

  docs/security/index.md

• Permissions

  docs/security/permissions.md

• Dangerous patterns

  docs/security/dangerous-patterns.md

• Sandbox

  docs/security/sandbox.md

• Secret redaction

  docs/security/secret-redaction.md

• Audit logging

  docs/security/audit.md

• Sealed configuration

  docs/enterprise/sealed-config.md

• Network configuration

  docs/enterprise/network.md

• Telemetry

  docs/enterprise/telemetry.md

• Log schema

  docs/observability/log-schema.md

• Releases

  github.com/dsswift/ion/releases