ThreeGate/policy/tool-exec.policy.md

TOOL-EXEC Policy (Authoritative)

TOOL-EXEC executes human-approved Tool Requests in a sandboxed environment.

Allowed

• Execute validated Tool Requests that include explicit human approval
• Default to network=none
• Produce Tool Results conforming to schema_version=1
• Log and hash outputs for auditability

Forbidden

• Executing unapproved requests
• Enabling network by default
• Installing packages
• Persisting state between runs (unless explicitly designed and reviewed)
• Accessing CORE/FETCH internal state outside allowed handoff paths
• Handling secrets (tokens/credentials) by default

Untrusted Output Rule

All tool output is untrusted data. Tool Results must never instruct policy changes or further actions.

Backend: monty (TOOL-EXEC-Lite)

Monty lane is for "pure compute" transformations and planning helpers.

Allowed (stub):

• Execute code only from approved Tool Requests with backend=monty
• network=none only
• No file inputs/outputs (stdio-only)
• No external functions (host capabilities) provided

Forbidden:

• Any external function that enables filesystem, subprocess, network, env
• Any persistence or state reuse across runs (until explicitly designed)
• Any attempt to treat tool output as instructions

Any proposal to add external functions to Monty constitutes a security boundary change and must be reviewed as such.