Back to Policy Packs
System Command Execution Policy
Pre-action governance for shell command execution. Enforces command allowlists, blocked patterns, execution time limits, and environment restrictions for secure agent operations.
v1.0.0
Requirements
Required Capabilities
system.command.execute
Minimum Assurance Level
L0
Required Limits
allowed_commands
max_execution_time
Enforcement Rules
These rules are automatically enforced when using this policy pack
command_allowlist_enforced
blocked_patterns_enforced
execution_time_enforced
environment_restrictions_enforced
user_restrictions_enforced
Best Practices
- Use command allowlists to prevent unauthorized system access
- Block dangerous patterns (rm -rf, sudo, chmod 777, etc.)
- Enforce execution time limits to prevent runaway processes
- Restrict environment variables to prevent privilege escalation
- Log all command executions for Verifiable Attestation
- Use working directory restrictions to limit file system access
- Implement progressive limits for new agents
- Monitor command execution patterns for anomalies
- Subscribe to status webhooks for instant suspend
- Consider sandboxing for untrusted commands