Policy packs

A pack is a named group of rules you install instead of writing. They exist for the same reason a linting preset does: the rules everybody needs are the rules everybody gets subtly wrong.

bash

memnox policy packs                      # list them
memnox policy install production-safety
memnox policy install terminal-safety data-privacy

memnox setup installs a starter set automatically, chosen by deterministic, offline detection, dependency names and file existence, no model and no network. The same repository always scaffolds the same packs, and detection only ever adds. --no-detect opts out.

What ships

Core safety

Pack

production-safety

No AI-initiated destruction or deployment in production

terminal-safety

Shell commands that cannot be undone

human-approval

High-stakes actions pause for an operator

repository-protection

Git history is evidence, rewriting it needs a human

policy-bypass-protection

An agent must not disable the thing governing it

Code and secrets

Pack

payments

Money-handling code changes go through security review

auth-and-secrets

Auth code and credential files are not edited unattended

supply-chain

New third-party code and CI configuration get reviewed

framework-db-reset

ORM reset verbs that drop every table without looking like it

Infrastructure

Pack

infrastructure

Destructive cloud and cluster operations need a human

aws

Destructive and privilege-changing AWS operations

cloudflare

Destructive Wrangler operations

read-only-production

Freezes an environment: reads pass, writes do not

Data

Pack

data-privacy

Bulk data leaving the system is a human decision

customer-data

CRM and analytics are not read or shared in bulk

data-egress

Transfers to destinations you did not approve

regulated-data

Handling rules for regulated categories

data-residency · sovereignty

Keep workloads inside approved regions

Money

Pack

money-movement

Transfers, payouts, refunds, treasury operations

executive-approval

The highest-risk actions need more than one signature

Agent behaviour

Pack

agent-delegation

A spawned subagent inherits reach without inheriting review

agent-chain

Privilege escalation and message passing across agent chains

autonomous-persistence

An agent must not arrange to keep acting after the session

workflow-autonomy

How far an unattended multi-step workflow may go

model-governance · provider-governance

Which models and vendors may be used

Per-agent and per-surface

Pack

claude-code · cursor · codex

Scoped to that agent by name

assistant-agent

Agents acting on a real inbox and calendar

browser-agent · browser-domains

Agents driving a real browser session

Packs in the console

The hosted control plane manages packs per workspace and per environment, so the same pack can be enforcing in staging while still observing in production.

Console → Safety packs, showing installed packs with their per-environment state

screenshot slot, save as public/screens/…png and set src

Installing a pack in observe mode first is the normal path. The console shows what each pack would have stopped before you enforce it.

Composing with your own rules

Packs and your rules evaluate together under the same most-restrictive-wins semantics. You do not fork a pack to tighten it, you add a rule beside it.

To loosen one, do not edit the pack: remove it and write the narrower rule yourself, so the diff shows what your organization actually chose.

Writing policies

The YAML underneath every pack.

From observing to enforcing

Turning a pack on without wedging anybody's editor.