policy.example.toml

# What this place allows. Copy it, cut it down to what you actually mean, and run
#
#     aviary check --policy policy.toml
#
# It exits non-zero on a violation, so it belongs in CI beside the tests.
#
# Every clause below is expressed in the audit's own terms — rule ids, the capability suffix A04
# carries, severities, counts already on the inventory. There is deliberately no way to ask a new
# question here: a policy language that could would be a second analysis engine to keep in agreement
# with the one that has the measurements behind it.
#
# An omitted clause is not a clause set to zero. Nothing here has a default.
schema_version = 1

# Findings that are unacceptable, by rule id. `aviary audit` prints the id beside every finding.
#
# A04 reports seven distinct capabilities under one rule, so name the one you mean:
#   A04.remoteExec    downloads and executes remote code
#   A04.privateKey    reads a private SSH key
#   A04.sshKeys       reads your SSH directory
#   A04.awsCredentials, A04.credentialFile, A04.netrc, A04.dynamicEval, A04.obfuscated
deny = [
  "A04.remoteExec",
  "A04.privateKey",
  # A credential in cleartext on disk.
  "A05",
  # A hook pointing at a file that is not there — including a registered skill that cannot load.
  "A06",
]

[max]
# Findings by severity. `high = 0` is the strict reading; start looser and tighten.
high = 0
# Hooks that run on every tool call, fleet-wide. The expensive number, and not the same as "hooks
# with no matcher" — most events are not tool calls.
per_call_hooks = 40
# The longest any single hook may declare. A blocking event with a long timeout is an agent that
# hangs without saying why.
hook_timeout_seconds = 300
# Entries no installer can be attributed to: the ones a person typed. Not a fault — this is the
# number a team may want to know has not grown.
unattributed = 20

[owners]
# Tools permitted to install configuration into your agents. Leave empty for no opinion; once it has
# anything in it, a tool that is not listed is a violation.
#
# Get the current list from `aviary fleet` — the first column is exactly these labels.
allow = []
# Or name the ones that are not welcome, and leave `allow` empty.
deny = []

[instructions]
# The one surface that arrives from outside without being installed: `AGENTS.md`, `CLAUDE.md`,
# `.cursorrules`. An agent reads the file whole and follows it, so a cloned repository is a way for
# somebody else's prose to become instructions to a process that can read your files and run commands.
#
# `aviary instructions` lists them with the repository owner each came from.
#
# Owners whose instruction files may be followed here. Empty means no opinion.
allow_owners = []
# Or refuse all of them, whoever owns the repository.
forbid_cloned = false
# The largest a single one may be — it is loaded in full, every conversation. The biggest on the
# survey machine is 54 KB, read by two different agents.
max_bytes = 20000

[mcp]
# MCP servers permitted, by the name the config gives them. `aviary inventory` lists them.
allow = []