Back to Policy Packs
File Write Access Policy
Pre-action governance for file write operations. Enforces path allowlists, blocked paths (system directories, binaries), extension restrictions, size limits, and rate limiting for secure agent file modifications.
v1.0.0
Requirements
Required Capabilities
data.file.write
Minimum Assurance Level
L0
Required Limits
allowed_paths
Enforcement Rules
These rules are automatically enforced when using this policy pack
path_allowlist_enforced
blocked_paths_enforced
extension_restrictions_enforced
file_size_enforced
rate_limiting_enforced
Best Practices
- Use path allowlists to restrict file writes to specific directories
- Block system directories (/etc, /bin, /usr/bin, /System, C:\Windows)
- Enforce allowed file extensions to prevent malicious file creation
- Set file size limits to prevent disk exhaustion attacks
- Implement rate limiting (writes per hour) to detect anomalous behavior
- Log all file write operations for Verifiable Attestation and rollback
- Use working directory restrictions in combination with path allowlists
- Monitor write patterns for anomalies (e.g., writing to 100s of files/hour)
- Subscribe to status webhooks for instant suspend on suspicious activity
- Consider implementing write sandboxing for untrusted agents
- Audit logs should capture file path, size, hash, and timestamp