Policy Reference

Warden evaluates every tool call against compiled policy categories. Each category has different enforcement behavior.

Safety

Hard deny. Commands matching safety patterns are blocked immediately. Covers: rm -rf, sudo, reverse shells, credential theft, disk formatting. Zero-trace enforcement — blocking AI attribution written into commits, configs, and files — is folded into this set and is always on.

Git mutation blocking is a separate, opt-in set: see git_readonly in rules.toml.

Destructive

Hard deny. Tools that auto-modify code or destroy state: knip --fix, sg -r, madge --image, npm prune, cargo clean, docker system prune, docker volume rm, truncate, shred, npm run eject, terraform destroy -auto-approve, kubectl delete namespace, helm uninstall, wsl --unregister.

Hallucination

Split by confidence. The hard-deny list covers fabricated invocations with no legitimate reading. A larger advisory list covers patterns that are usually a mistake but sometimes deliberate — those inject a warning and let the command run.

Substitution

Transform or teach. Some rules rewrite the command before it runs (ls → eza, du → dust); most attach the modern equivalent to the result and let the original proceed (grep → rg, find → fd, cat → bat, curl → xh). One denies: sd on Windows.

Advisory

Soft guidance. Non-blocking messages injected when the agent could benefit from a hint (e.g., “4 files edited since last build — consider running tests”).

Prompt Injection

Detection. Tool output is scanned for prompt injection attempts (instruction hijack, role manipulation, exfiltration).

Rule Precedence

1. Safety denials (highest priority)
2. Destructive denials
3. Hallucination denials
4. Substitution transforms
5. Advisory suggestions (lowest priority)

Custom rules in rules.toml can add patterns to any category. Disabling by ID is narrower: the safety, destructive, hallucination, zero_trace, permission, and git_readonly namespaces are refused outright, and a project-level .warden/rules.toml may only disable substitution.* and advisory.*. See rules.toml.