Rule sets and protections
Open, Guarded and Hardened, every ready-made protection they switch on, suggestions from your repo, and how Global and project settings combine.
You don't have to write rules to be protected. Warden ships protections: ready-made rules for one kind of risk each, such as reading .env files, force-pushing or piping a script from the internet into a shell. A rule set is a starting position for all of them at once.
Pick a rule set#
Open Policies (for all projects, or in a project) and pick a Profile:
| Rule set | In the app | For |
|---|---|---|
| Open | runs what you don't block | Exploring. Only the basics are enforced. |
| Guarded | asks before risky steps | Day-to-day work. Secrets, destructive commands and force-pushes are blocked; risky steps ask you. The default. |
| Hardened | blocks risky steps | Sensitive repositories. Risky steps are blocked rather than asked about. |
Then change any single protection to Allow, Ask or Block. The Policies header tells you when a scope differs from Guarded, and by how many protections.
Every protection#
| Group | Protection | Open | Guarded | Hardened |
|---|---|---|---|---|
| Basic security | Keep file access inside the project | BLOCKED | BLOCKED | BLOCKED |
| System temp folder | RUNS | RUNS | ASKS YOU | |
| Protect Warden's own guardrails | BLOCKED | BLOCKED | BLOCKED | |
| Secrets & credentials | Environment & secret files | RUNS | BLOCKED | BLOCKED |
| Private keys | RUNS | BLOCKED | BLOCKED | |
| Cloud credential reads | RUNS | BLOCKED | BLOCKED | |
| Secrets written into files | RUNS | ASKS YOU | BLOCKED | |
| Shell & processes | Destructive commands | RUNS | BLOCKED | BLOCKED |
| Bulk deletion | RUNS | ASKS YOU | BLOCKED | |
| Remote code piping | RUNS | BLOCKED | BLOCKED | |
| Unverifiable commands | RUNS | ASKS YOU | BLOCKED | |
| Privilege escalation | RUNS | BLOCKED | BLOCKED | |
| Package installation | RUNS | ASKS YOU | BLOCKED | |
| Cloud & SaaS config changes | ASKS YOU | ASKS YOU | BLOCKED | |
| Git & version control | Force push | RUNS | BLOCKED | BLOCKED |
| Push to protected branches | RUNS | ASKS YOU | BLOCKED | |
| History rewriting | RUNS | ASKS YOU | BLOCKED | |
| Identity changes | RUNS | BLOCKED | BLOCKED | |
| CI/CD pipeline changes | RUNS | ASKS YOU | BLOCKED | |
| Network | Paste-site destinations | RUNS | BLOCKED | BLOCKED |
| Network fetch commands | RUNS | RUNS | ASKS YOU | |
| Scripts in the Browser pane | ASKS YOU | ASKS YOU | BLOCKED |
The basics (staying inside the project, and protecting Warden's own settings and rule files) stay on under every rule set, so an agent can't switch its own guardrails off.
Global and project#
- Global applies to every project. A fresh install starts Global on Guarded.
- A project can set its own rule set and protections, but can only be stricter than Global. Policies says so: Global enforces Guarded - a project can only tighten it.
Suggestions from your repository#
On a project's Policies tab, Warden may suggest protections based on what is in the repository: secret files, key files, a git remote, CI configuration, dependency manifests, infrastructure-as-code, deploy configs and database migrations. Each suggestion shows the evidence it found, and can only tighten. This runs on your Mac with no model and sends nothing anywhere.
Beyond protections#
- Custom rules cover anything the protections don't. See Writing rules.
- Automated runs can have stricter settings than your chats. See Automated runs.
- Protect data by model adds rules that keep some data on models you trust. See Rule recipes.