Policy registry
HOL Guard policy recipes
Twenty reviewed starting points for common agent-security decisions. Each recipe uses a narrow matcher, includes safe test cases and limitations, and opens the existing Policy Studio for review before rollout.
A recipe is not an automatically enforced rule. Applying a reviewed policy through Guard Cloud uses the existing Guard policy-bundle delivery path, including RSA-PSS signing when policy-bundle signing is configured.
GPR-001 · critical
reviewReview secret-file reads
Require review before supported agents read common local secret files.
Matcher: path = .env
GPR-002 · high
reviewReview untrusted package installs
Require review before supported package-install actions use an untrusted package.
Matcher: package = untrusted-package
GPR-003 · critical
blockBlock known-malicious package installs
Block supported install actions for packages already classified as malicious.
Matcher: package = malicious-package
GPR-004 · high
reviewReview remote install scripts
Require review before a supported shell action invokes a remote installer pattern.
Matcher: command = curl
GPR-005 · high
reviewReview new MCP servers
Require review when a supported harness attempts to use an MCP server that has not been reviewed.
Matcher: mcp = unreviewed-mcp-server
GPR-006 · critical
reviewReview destructive shell commands
Require review before supported shell execution reaches a destructive command family.
Matcher: command = rm
GPR-007 · low
allowAllow a reviewed domain
Allow network actions to a domain that your team has explicitly reviewed and approved.
Matcher: domain = trusted.example.com
GPR-008 · medium
allowAllow a reviewed skill
Allow a specific skill identifier after its source and behavior have been reviewed.
Matcher: tool = trusted-skill
GPR-009 · high
reviewReview high-risk tool actions
Route a named high-risk tool action to human review before execution.
Matcher: tool = high-risk-action
GPR-010 · high
blockBlock a dangerous tool
Block a named tool after a security review determines that it should not execute.
Matcher: tool = dangerous-tool
GPR-011 · critical
reviewReview SSH key reads
Require review before supported file-read surfaces access a common SSH private-key path.
Matcher: path = .ssh/id_rsa
GPR-012 · critical
reviewReview cloud credential reads
Require review before supported file-read surfaces access a common cloud credential path.
Matcher: path = .aws/credentials
GPR-013 · high
reviewReview package-manager configuration access
Require review when supported file-read surfaces access package-manager configuration that can redirect installs.
Matcher: path = .npmrc
GPR-014 · critical
reviewReview Git credential access
Require review before supported file-read surfaces access a Git credential store.
Matcher: path = .git-credentials
GPR-015 · high
blockBlock production package installs
Provide a conservative starting point for blocking a reviewed production package-install target.
Matcher: package = production-package
GPR-016 · high
reviewReview remote MCP connections
Require review before using a named remote MCP endpoint or server identity.
Matcher: mcp = remote-mcp-server
GPR-017 · high
reviewReview browser automation tools
Require review before a named browser automation tool performs a supported action.
Matcher: tool = browser-automation
GPR-018 · critical
blockBlock a reviewed destructive command
Block a specific destructive command family after confirming it is unsafe for the target workspace.
Matcher: command = mkfs
GPR-019 · high
reviewReview plugin execution
Require review before a named unreviewed plugin or skill-like tool executes.
Matcher: tool = unreviewed-plugin
GPR-020 · low
allowAllow a reviewed workflow
Allow a named routine workflow only after its actions have been reviewed and bounded.
Matcher: tool = trusted-workflow