Policy Recipes

Ready-to-Use Policy Examples

Copy and customize these policy recipes for common scenarios. Each recipe is production-tested and ready to use.

Basic Allow + Approval + Default Deny

Most common pattern: allow some actions, require approval for others, deny everything else

rules:
  - match: { tool: "http", op: "*" }
    allow: true
    description: "Allow HTTP"

  - match: { tool: "shell", op: "*" }
    require_approval: true
    description: "Shell requires approval"
    risk: "medium"

  - match: { tool: "*", op: "*" }
    deny: true
    description: "Default deny"

Deny Destructive Shell Commands

Block dangerous shell commands using pattern matching

rules:
  - match:
      tool: "shell"
      op: "*"
      pattern: "rm -rf|shutdown|reboot|mkfs|:(){:|:&};:"
    deny: true
    description: "Block destructive shell commands"
    risk: "high"

  - match: { tool: "*", op: "*" }
    deny: true
    description: "Default deny"

Require Approval for Large Stripe Refunds

Use amount_gt to require approval for high-value financial operations

rules:
  - match:
      tool: "stripe"
      op: "refund"
      amount_gt: 1000
    require_approval: true
    description: "Large refunds require approval"
    risk: "medium"

  - match: { tool: "stripe", op: "*" }
    allow: true
    description: "Allow other Stripe operations"
    risk: "low"

  - match: { tool: "*", op: "*" }
    deny: true
    description: "Default deny"

Allow HTTP Requests

Simple policy to allow all HTTP operations.

rules:
  - match:
      tool: "http"
      op: "*"
    allow: true
    description: "Allow all HTTP operations"

  - match: { tool: "*", op: "*" }
    deny: true
    description: "Default deny (first-match wins)"

Deny Unknown Tools

Only allow explicitly trusted tools, deny everything else.

rules:
  - match:
      tool: "trusted_tool"
      op: "*"
    allow: true
    description: "Allow trusted tool"

  - match: { tool: "*", op: "*" }
    deny: true
    description: "Deny everything else (default deny)"

Shell Commands Require Approval

Require approval for all shell operations while allowing other tools.

rules:
  - match: { tool: "http", op: "*" }
    allow: true
    description: "Allow HTTP"

  - match: { tool: "shell", op: "*" }
    require_approval: true
    description: "Shell requires approval"
    risk: "medium"

  - match: { tool: "*", op: "*" }
    deny: true
    description: "Default deny (first-match wins)"

Tips for Writing Policies

Best practices for creating effective policies

1
Order matters
Put specific rules before general ones (first-match wins)
2
Always include default deny
End with a catch-all deny rule for security
3
Use descriptions
Help others understand your rules with clear descriptions
4
Set risk levels
Helps prioritize approvals and understand action severity
5
Test policies
Use faracore policy-test before deploying to production