Policy schema

Sentinel policies use schema version 1 and contain a list of deterministic invariants. Every invariant has:

• a unique identifier;
• an implemented invariant type;
• an enforcement action;
• the values required by that type.

Unknown shapes and unimplemented invariant types fail validation.

Implemented invariant types

• command.deny-pattern blocks matching command content.
• tool.requires-approval requires an approval for selected tools.
• filesystem.allowed-roots constrains filesystem paths to configured roots.

Enforcement actions

The schema recognizes:

• log;
• warn;
• pause;
• block;
• rollback;
• terminate.

The runtime can enforce only behavior implemented for the selected invariant and action. A valid document is not evidence that an unsupported control exists.

Validate

odinn experimental sentinel validate ./policy.yml

Test a tool request before using the policy:

odinn experimental sentinel test \
  ./policy.yml \
  --tool workspace.readText \
  --input-json '{"path":"README.md"}'

Advanced: minimal policy document

{
  "version": 1,
  "invariants": [
    {
      "id": "deny-production-apply",
      "type": "command.deny-pattern",
      "values": ["terraform apply"],
      "enforcement": "block"
    }
  ]
}

Policy documents are untrusted input until reviewed. Sentinel complements the ordinary capability policy; it does not replace the gateway, extension, network, or OS isolation boundary.