Policy Enforcer

// Allow all read-oriented tools, plus web search (no fetch)
permit (
    principal,
    action == Action::"MCP::Tool::call",
    resource
) when {
    resource == Tool::"Read" || resource == Tool::"Glob" ||
    resource == Tool::"Grep" || resource == Tool::"WebSearch"
};

// No writes, no shell, no fetch
forbid (
    principal,
    action == Action::"MCP::Tool::call",
    resource
) when {
    resource == Tool::"Write" || resource == Tool::"Edit" ||
    resource == Tool::"Bash" || resource == Tool::"WebFetch"
};

// Reads are free
permit (
    principal,
    action == Action::"MCP::Tool::call",
    resource
) when {
    resource == Tool::"Read" || resource == Tool::"Glob" || resource == Tool::"Grep"
};

// Writes and edits only inside the project. `like` matches the raw string,
// so it is not a path containment check; the next rule rejects `..`.
permit (
    principal,
    action == Action::"MCP::Tool::call",
    resource
) when {
    (resource == Tool::"Write" || resource == Tool::"Edit") &&
    context has input && context.input has file_path &&
    context.input.file_path like "/path/to/project/*"
};

forbid (
    principal,
    action == Action::"MCP::Tool::call",
    resource
) when {
    (resource == Tool::"Write" || resource == Tool::"Edit") &&
    context has input && context.input has file_path &&
    (context.input.file_path like "*/../*" || context.input.file_path like "*/..")
};

// Safe shell commands only. git is limited to read subcommands. Interpreter
// permits (npm, node, python, make) run arbitrary code, so they are only as
// safe as the project's scripts.
permit (
    principal,
    action == Action::"MCP::Tool::call",
    resource == Tool::"Bash"
) when {
    context has input && context.input has command &&
    (context.input.command like "git status*" ||
     context.input.command like "git diff*" ||
     context.input.command like "git log*" ||
     context.input.command like "git show*" ||
     context.input.command like "npm*" ||
     context.input.command like "pnpm*" ||
     context.input.command like "yarn*" ||
     context.input.command like "ls*" ||
     context.input.command like "cat*" ||
     context.input.command like "pwd*" ||
     context.input.command like "echo*" ||
     context.input.command like "test*" ||
     context.input.command like "node*" ||
     context.input.command like "python*" ||
     context.input.command like "make*")
};

// No chaining, substitution, redirection, or file output, so a permitted
// prefix cannot carry a second command or write a file (`git diff --output`).
// `&` also covers `&&`, `|` covers `||`, `$` covers `$(` and variables such
// as `$API_TOKEN`, and `<` covers input redirects, `<(` and `<<`; this
// denies `2>&1` too.
forbid (
    principal,
    action == Action::"MCP::Tool::call",
    resource == Tool::"Bash"
) when {
    context has input && context.input has command &&
    (context.input.command like "*;*" ||
     context.input.command like "*&*" ||
     context.input.command like "*|*" ||
     context.input.command like "*$*" ||
     context.input.command like "*`*" ||
     context.input.command like "*>*" ||
     context.input.command like "*<*" ||
     context.input.command like "*\n*" ||
     context.input.command like "*--output*")
};

// Never destructive (substring match, so compound commands are caught)
forbid (
    principal,
    action == Action::"MCP::Tool::call",
    resource == Tool::"Bash"
) when {
    context has input && context.input has command &&
    (context.input.command like "*rm -rf*" ||
     context.input.command like "*dd if=*" ||
     context.input.command like "*mkfs*" ||
     context.input.command like "*shred*")
};

// Reads are allowed
permit (
    principal,
    action == Action::"MCP::Tool::call",
    resource
) when {
    resource == Tool::"Read" || resource == Tool::"Grep"
};

// Writes only to the deployment and config directories, with no `..`
// segments (`like` matches the raw string, not a resolved path)
permit (
    principal,
    action == Action::"MCP::Tool::call",
    resource == Tool::"Write"
) when {
    context has input && context.input has file_path &&
    (context.input.file_path like "/path/to/project/deployments/*" ||
     context.input.file_path like "/path/to/project/config/*")
};

forbid (
    principal,
    action == Action::"MCP::Tool::call",
    resource
) when {
    (resource == Tool::"Write" || resource == Tool::"Edit") &&
    context has input && context.input has file_path &&
    (context.input.file_path like "*/../*" || context.input.file_path like "*/..")
};

// Shell only for explicit deployment commands, with no chaining, `$`
// expansion, or redirection (`>` or `<`; `&` also denies `2>&1`).
// Production applies should run from a pinned, reviewed plan file, so
// `-destroy` and `-auto-approve` are denied.
permit (
    principal,
    action == Action::"MCP::Tool::call",
    resource == Tool::"Bash"
) when {
    context has input && context.input has command &&
    (context.input.command like "kubectl apply*" ||
     context.input.command like "terraform plan*" ||
     context.input.command like "terraform apply*")
};

forbid (
    principal,
    action == Action::"MCP::Tool::call",
    resource == Tool::"Bash"
) when {
    context has input && context.input has command &&
    (context.input.command like "*;*" ||
     context.input.command like "*&*" ||
     context.input.command like "*|*" ||
     context.input.command like "*$*" ||
     context.input.command like "*`*" ||
     context.input.command like "*>*" ||
     context.input.command like "*<*" ||
     context.input.command like "*\n*" ||
     context.input.command like "*-destroy*" ||
     context.input.command like "*-auto-approve*")
};

// Everything else is denied: Cedar denies any call that no permit matches,
// so no catch-all forbid is needed.