Policy packs
CHAIN INTACT
acme-baseline 1.1.0
The operator baseline is intersected with whatever a plugin's own manifest declares, and the operator can only ever narrow. A pack cannot grant a capability an author never asked for.
fs:readfs:writenet:fetchskills:invoke
OWASP Top 10 for LLM Applications — 2026OWASP Top 10 for Agentic Applications — 2026
CLAUSE
RULE
EFFECT
PRAE-001
Writes stay in the workspace
capability fs:write · path outside ./src/**, ./tests/**, ./docs/**
OWASP LLM 2026 · LLM03 Excessive Agency
OWASP Agentic 2026 · ASI02 Tool Misuse and Exploitation
capability fs:write · path outside ./src/**, ./tests/**, ./docs/**
OWASP LLM 2026 · LLM03 Excessive Agency
OWASP Agentic 2026 · ASI02 Tool Misuse and Exploitation
DENY
PRAE-002
Credentials are never read by an agent
capability fs:read · path inside ./.env, ./.env.*, **/credentials/**, **/*.pem
OWASP LLM 2026 · LLM02 Sensitive Information Disclosure
OWASP Agentic 2026 · ASI03 Identity and Privilege Abuse
capability fs:read · path inside ./.env, ./.env.*, **/credentials/**, **/*.pem
OWASP LLM 2026 · LLM02 Sensitive Information Disclosure
OWASP Agentic 2026 · ASI03 Identity and Privilege Abuse
DENY
PRAE-010
The network is an allowlist
capability net:fetch · host not in .acme.internal, registry.npmjs.org, .github.com
OWASP LLM 2026 · LLM03 Excessive Agency
OWASP Agentic 2026 · ASI02 Tool Misuse and Exploitation
capability net:fetch · host not in .acme.internal, registry.npmjs.org, .github.com
OWASP LLM 2026 · LLM03 Excessive Agency
OWASP Agentic 2026 · ASI02 Tool Misuse and Exploitation
ASK
PRAE-011
Network budget
capability net:fetch · more than 20
OWASP LLM 2026 · LLM06 Unbounded Consumption
OWASP Agentic 2026 · ASI08 Cascading Failures
capability net:fetch · more than 20
OWASP LLM 2026 · LLM06 Unbounded Consumption
OWASP Agentic 2026 · ASI08 Cascading Failures
ASK
PRAE-020
Deletes are held for a human
tool str_replace_editor, write · command = delete
OWASP LLM 2026 · LLM03 Excessive Agency
OWASP Agentic 2026 · ASI02 Tool Misuse and Exploitation
tool str_replace_editor, write · command = delete
OWASP LLM 2026 · LLM03 Excessive Agency
OWASP Agentic 2026 · ASI02 Tool Misuse and Exploitation
ASK
PRAE-030
Reads are recorded
capability fs:read
capability fs:read
WARN
Ordering
When several rules match one call the strongest effect wins — deny over ask over correct over warn — and every match stays in the trace. That is what makes a pack safe to extend: appending a rule can raise a decision's strength and never lower it.