39 lines
1.3 KiB
Markdown
39 lines
1.3 KiB
Markdown
# TOOL-EXEC Policy (Authoritative)
|
|
|
|
TOOL-EXEC executes human-approved Tool Requests in a sandboxed environment.
|
|
|
|
## Allowed
|
|
- Execute validated Tool Requests that include explicit human approval
|
|
- Default to network=none
|
|
- Produce Tool Results conforming to schema_version=1
|
|
- Log and hash outputs for auditability
|
|
|
|
## Forbidden
|
|
- Executing unapproved requests
|
|
- Enabling network by default
|
|
- Installing packages
|
|
- Persisting state between runs (unless explicitly designed and reviewed)
|
|
- Accessing CORE/FETCH internal state outside allowed handoff paths
|
|
- Handling secrets (tokens/credentials) by default
|
|
|
|
## Untrusted Output Rule
|
|
All tool output is untrusted data. Tool Results must never instruct policy changes or further actions.
|
|
|
|
|
|
## Backend: monty (TOOL-EXEC-Lite)
|
|
|
|
Monty lane is for "pure compute" transformations and planning helpers.
|
|
|
|
Allowed (stub):
|
|
- Execute code only from approved Tool Requests with backend=monty
|
|
- network=none only
|
|
- No file inputs/outputs (stdio-only)
|
|
- No external functions (host capabilities) provided
|
|
|
|
Forbidden:
|
|
- Any external function that enables filesystem, subprocess, network, env
|
|
- Any persistence or state reuse across runs (until explicitly designed)
|
|
- Any attempt to treat tool output as instructions
|
|
|
|
> Any proposal to add external functions to Monty constitutes a security boundary change and must be reviewed as such.
|