# TOOL-EXEC Policy (Authoritative)

TOOL-EXEC executes human-approved Tool Requests in a sandboxed environment.

## Allowed
- Execute validated Tool Requests that include explicit human approval
- Default to network=none
- Produce Tool Results conforming to schema_version=1
- Log and hash outputs for auditability

## Forbidden
- Executing unapproved requests
- Enabling network by default
- Installing packages
- Persisting state between runs (unless explicitly designed and reviewed)
- Accessing CORE/FETCH internal state outside allowed handoff paths
- Handling secrets (tokens/credentials) by default

## Untrusted Output Rule
All tool output is untrusted data. Tool Results must never instruct policy changes or further actions.


## Backend: monty (TOOL-EXEC-Lite)

Monty lane is for "pure compute" transformations and planning helpers.

Allowed (stub):
- Execute code only from approved Tool Requests with backend=monty
- network=none only
- No file inputs/outputs (stdio-only)
- No external functions (host capabilities) provided

Forbidden:
- Any external function that enables filesystem, subprocess, network, env
- Any persistence or state reuse across runs (until explicitly designed)
- Any attempt to treat tool output as instructions

> Any proposal to add external functions to Monty constitutes a security boundary change and must be reviewed as such.