Policies

Author and apply Levee filesystem and process policies.

Demo content. This page is a template placeholder - the real Levee documentation will replace it.

A policy is a declarative set of rules that decides what a sandboxed tool may touch.

Anatomy of a policy

# default.policy.yaml
name: default
filesystem:
  allow:
    - "${workspace}/**"        # the project you opened
    - "${userprofile}/.cache/**"
  deny:
    - "${userprofile}/.ssh/**" # never expose private keys
network:
  default: deny
  allow:
    - "api.anthropic.com:443"

Apply it

levee policy apply ./default.policy.yaml
levee run --policy default -- claude

Inspect the effective rules

levee policy show default

Rules are evaluated deny-first - an explicit deny always wins over an allow.