CLI · Policy

Policy commands

Policy maps observed evidence to deterministic allow, review, or deny outcomes. The CLI provides three implemented subcommands.

Initialize

agentdiff policy init [--output PATH] [--force]

By default, this writes a conservative agentdiff.yaml in the current directory and refuses to overwrite an existing file.

agentdiff policy init
agentdiff policy init --output config/agentdiff.yaml

Use --force only when replacing the destination is intentional.

Validate

agentdiff policy validate [--policy PATH]

agentdiff policy validate --policy agentdiff.yaml

Validation checks schema version, supported actions and modes, numeric limits, and rule structure before a transaction uses the policy.

Explain a path

agentdiff policy explain <path> [--policy PATH] [--format summary|json]

agentdiff policy explain .env --policy agentdiff.yaml
agentdiff policy explain src/parser.py --format json

The result includes the selected action and exact matching rule, which is useful for policy reviews and debugging precedence.

Rule order

Filesystem decisions use the defined precedence and preserve rule provenance. See Mutation policy for the schema, path normalization, and fail-closed behavior.

Policy is evaluation in local mode

A deny outcome does not turn the local observer into a filesystem sandbox. Command-level policy can block launch; mutation policy classifies the state observed around execution.