Back to Policy Packs
File Read Access Policy
Pre-action governance for file read operations. Enforces path allowlists, blocked patterns (credentials, SSH keys, secrets), file size limits, and audit trails for secure agent file access.
v1.0.0
Requirements
Required Capabilities
data.file.read
Minimum Assurance Level
L0
Required Limits
allowed_paths
Enforcement Rules
These rules are automatically enforced when using this policy pack
path_allowlist_enforced
blocked_patterns_enforced
file_size_enforced
extension_restrictions_enforced
Best Practices
- Use path allowlists to restrict file access to specific directories
- Block sensitive file patterns (SSH keys, credentials, .env files)
- Enforce file size limits to prevent memory exhaustion
- Log all file read operations for Verifiable Attestation
- Use working directory restrictions in combination with path allowlists
- Implement progressive limits for new agents (start restrictive, expand based on behavior)
- Monitor file access patterns for anomalies (e.g., reading 1000s of files)
- Subscribe to status webhooks for instant suspend on suspicious activity
- Consider using symbolic link restrictions to prevent directory traversal
- Audit logs should capture file path, size, and timestamp