Skip to content

Writing CEL Security Policies

Declarative policies are authored in ctxsec.yaml under the policies: block.

Policy Syntax

A policy definition includes a descriptive name, target event, and a CEL expression:

version: "1.0"

policies:
  - name: "block-destructive-commands"
    description: "Hard block recursive deletion and un-inspected shell downloads"
    target: "run_command"
    rule: >
      request_command.contains('rm -rf /') ||
      (request_command.contains('curl') && request_command.contains('| bash'))
    action: "deny"

  - name: "researcher-read-only"
    description: "Restrict researcher subagents from modifying files"
    target: "write_to_file|replace_file_content"
    rule: "request_caller_role == 'researcher'"
    action: "deny"

  - name: "require-confirmation-for-git-push"
    description: "Prompt user before pushing git branches"
    target: "run_command"
    rule: "request_command.contains('git push')"
    action: "ask"

Action Semantics

  • deny: Immediate hard block. The tool execution is cancelled and an error is returned to the agent.
  • allow: The tool call proceeds directly to execution.
  • ask: Pauses execution and asks the developer for interactive confirmation in their terminal or IDE UI.