Skip to main content

Policy

Every change a task makes, and every network connection, is judged by a policy before it can reach your folder or the network. The policy is written in Cedar, a small language for permission rules.

The three verdicts​

VerdictWhat happensShown as
passThe change goes in on commit; the connection goes through.policy: passes on its own
askThe change waits for your approval; the connection waits for your answer.policy: waits for approval
denyNever goes in, even when you approve.policy: denied

Each change that does not pass names the rule that stopped it:

policy: waits for approval
  package.json · waits for approval (manifests-and-lockfiles)

A rule that cannot decide, or a policy with an error, refuses.

The built-in policies​

You pick one on the first-run screen, in Settings → Policy, or with kule policy:

Balanced (the default)​

Pass on their own:

  • edits to ordinary files (source code, notes, documents, data);
  • a git branch moved forward (fast-forward) or a new branch;
  • connections to package registries over HTTPS (npm, Yarn, crates.io, NuGet, PyPI, RubyGems, Maven Central), and each agent's own model API while that agent runs.

Wait for you (ask):

  • manifests and lockfiles: package.json, package-lock.json, yarn.lock, Cargo.toml, Cargo.lock, go.mod, pyproject.toml, requirements*.txt, *.csproj, pom.xml, build.gradle and the rest;
  • what runs code on its own or steers an agent: CI (.github, .gitlab-ci*, …), editor settings (.vscode, .idea), dev containers, hook managers (.husky, lefthook.yml), toolchain and package manager settings (.npmrc, rust-toolchain.toml, build.rs), an agent's settings, instructions and MCP servers (.claude, CLAUDE.md, AGENTS.md, .mcp.json, …) and Kule's own .kule/;
  • a repository inside the folder, and symbolic links;
  • git config changes, history rewrites, branch deletions, switching HEAD, tags and other refs;
  • mass deletes: more than 200 deletions, or more than 20 in a folder that is not a git repository (a renamed file counts as a move, not a deletion);
  • any other connection, git hosts included.

Denied: git hooks, a nested repository's hooks too: they would run on your next git command, as you.

Names are matched in any folder and however they are cased.

Careful​

Every change to a file or to git waits for you. Only package registries, and each agent's own API while it runs, are reached without asking.

kule policy careful     # every change waits
kule policy balanced    # back to the default
kule policy             # print the rules that hold now

The full rule list, with each rule's id, is in Built-in policy rules.

Your own policy​

Save your own Cedar policy as ~/.kule/policy.cedar to replace the built-in one. Kule never overwrites it. Start from what kule policy prints.

A repository's own rules​

A repository can add refusals (Cedar forbid rules) in .kule/policy.cedar. They are read from the real workspace, never from the copy an agent edits, and they can only make the policy stricter.

A group's policy​

A group can judge its tasks by its own policy: the one for every task (the default), balanced or careful whatever the rest use, or one you write for the group. See kule group policy.

Approving, and remembering​

When something waits for you:

  • kule commit TASK --approve, or Approve and commit in the app, lets it in. Denied changes stay out.
  • --remember (or Don't ask again in this folder) stops asking, on this folder, about the files approved now (manifests, CI and project files).
  • Approve and remember on a connection question lets that host and port through on this folder.

Before an allowance is kept, Kule can show what it would have let through in your past tasks:

kule rules allow api.example.com:443        # shows what it would have let through
kule rules allow api.example.com:443 --yes  # keeps it
kule rules                                  # lists what you told Kule
kule rules forget ID                        # asks again

A remembered connection becomes a Cedar permit; a remembered file, a narrow exception to the rule that asked about it. Never remembered: what is denied, what asks for reasons other than a file's name (a mass delete, a history rewrite), and anything under .kule/.