Rules

Rules live in memnox.policies.toml at the root of your repository. Setup writes a starting set. Because it is a file, a rule change is a diff somebody can review.

A rule

Each rule says what it matches and what to answer.

toml

version = 1
 
[[policies]]
name = "no-force-push"
 
[policies.match]
actions = [ "git.push-force" ]
 
[policies.decision]
effect = "deny"
reason = "Rewriting published history is never automated."
 
[policies.decision.alternative]
action = "git.push"
note = "Push without --force, or open a pull request."

The reason is what a person reads when it fires. The alternative is what the agent does instead, so it finishes the work rather than giving up.

Common examples

Ask before deleting files:

toml

[[policies]]
name = "ask-before-delete"
 
[policies.match]
actions = [ "filesystem.delete" ]
 
[policies.decision]
effect = "ask"
reason = "Sometimes it really is the build folder, so a person should look."

Never read .env, and point at the safe copy:

toml

[[policies]]
name = "no-secrets"
 
[policies.match]
actions = [ "filesystem.read" ]
targets = [ ".env" ]
 
[policies.decision]
effect = "deny"
reason = "No task here needs the real keys."
 
[policies.decision.alternative]
action = "filesystem.read"
resource = ".env.example"
note = "Read .env.example for the names, never the real values."

Never tear down infrastructure:

toml

[[policies]]
name = "no-infra-teardown"
 
[policies.match]
actions = [ "terraform.destroy", "kubectl.delete-namespace" ]
 
[policies.decision]
effect = "deny"
reason = "Tearing down infrastructure is a person's call."
 
[policies.decision.alternative]
action = "terraform.plan"
note = "Run terraform plan -destroy and show it to a person."

Two things to know

A field you leave out matches everything. A rule with only actions applies in every folder, branch and environment.
The strictest answer wins. Order in the file does not matter.

Test before you rely on it

bash

memnox policy check                     # does every rule file load
memnox policy test "git push --force"   # what this action would get
memnox check "deploy the payments service"   # a whole plan, nothing run

Let Memnox write them

bash

memnox protect             # propose rules from what this machine has
memnox protect --apply     # write them
memnox protect --revert    # undo

Rules for a while

bash

memnox allow gh.pr-merge --for 2h --reason "release day"   # stop asking for a while
memnox freeze payments --for 2h --reason "incident"        # stop outside changes
memnox freeze --lift                                       # end it early

Every field a rule can carry is in the policy file reference.

Approvals

What happens when a rule says ask.

Policy file

Every field, with its type.