Security rules reference | Harden AIF documentation

Browse the built-in AIF rules that detect sensitive data, protect files and secrets, inspect tools, and stop dangerous actions.

AIF evaluates covered agent actions against built-in rules before an action runs. A rule ID in local history is the stable explanation for why AIF allowed, redacted, paused, or blocked that action.

This reference describes the built-in rules included in the current policy set. The outcome always depends on the action’s context: where data is going, whether it can be safely rewritten, and which protection policy applies.

How to read a rule

Allow means the protected action can continue.
Redact means AIF replaces a sensitive value with a safe placeholder when the action can still proceed safely.
Ask means AIF pauses the action for review.
Block means AIF stops the action before it runs.

Use the rule ID from a local record with the decision labels and local-history guide. If an outcome needs investigation, run aif doctor and follow the troubleshooting guide.

Sensitive values

These detectors recognize likely access tokens, credentials, secret keys, and similar authentication material. When safe, AIF redacts the value; otherwise it stops the action.

Rule ID	What activates the rule
`dlp:high_entropy_token`	A possible access token is detected.
`dlp:secret_key_value`	A named secret, password, credential, or API key is detected.
`dlp:canary_token`	A protected canary token is detected; the action is stopped.
`dlp:stripe_live_key`	A possible Stripe key is detected.
`dlp:stripe_webhook_secret`	A possible Stripe webhook secret is detected.
`dlp:anthropic_api_key`	A possible Anthropic API key is detected.
`dlp:openai_project_key`	A possible OpenAI project key is detected.
`dlp:openrouter_api_key`	A possible OpenRouter API key is detected.
`dlp:openai_key`	A possible OpenAI API key is detected.
`dlp:aws_access_key_id`	A possible AWS access key is detected.
`dlp:aws_secret_access_key`	A possible AWS secret key is detected.
`dlp:aws_bedrock_api_key`	A possible AWS Bedrock API key is detected.
`dlp:google_api_key`	A possible Google API key is detected.
`dlp:google_oauth_token`	A possible Google access token is detected.
`dlp:google_oauth_client_secret`	A possible Google OAuth client secret is detected.
`dlp:azure_storage_account_key`	A possible Azure storage key is detected.
`dlp:azure_ad_client_secret`	A possible Microsoft Entra client secret is detected.
`dlp:github_pat`	A possible GitHub access token is detected.
`dlp:github_fine_grained_pat`	A possible GitHub fine-grained token is detected.
`dlp:github_oauth_token`	A possible GitHub OAuth token is detected.
`dlp:gitlab_pat`	A possible GitLab access token is detected.
`dlp:huggingface_token`	A possible Hugging Face token is detected.
`dlp:huggingface_org_token`	A possible Hugging Face organization token is detected.
`dlp:slack_token`	A possible Slack token is detected.
`dlp:slack_app_token`	A possible Slack application token is detected.
`dlp:slack_webhook_url`	A possible Slack webhook is detected.
`dlp:pem_private_key`	A possible private key is detected.
`dlp:url_userinfo`	Credentials are found inside a web address.
`dlp:jwt`	A possible signed session token is detected.
`dlp:perplexity_api_key`	A possible Perplexity API key is detected.
`dlp:cohere_api_key`	A possible Cohere API key is detected.
`dlp:digitalocean_token`	A possible DigitalOcean token is detected.
`dlp:flyio_access_token`	A possible Fly.io access token is detected.
`dlp:npm_access_token`	A possible npm access token is detected.
`dlp:pypi_upload_token`	A possible PyPI upload token is detected.
`dlp:databricks_api_token`	A possible Databricks token is detected.
`dlp:sendgrid_api_token`	A possible SendGrid API key is detected.
`dlp:square_access_token`	A possible Square access token is detected.
`dlp:twilio_api_key`	A possible Twilio API key is detected.
`dlp:hashicorp_tf_api_token`	A possible Terraform Cloud token is detected.
`dlp:heroku_api_key`	A possible Heroku API key is detected.
`dlp:cloudflare_origin_ca_key`	A possible Cloudflare origin key is detected.
`dlp:telegram_bot_token`	A possible Telegram bot token is detected.
`dlp:postman_api_token`	A possible Postman API key is detected.
`dlp:planetscale_token`	A possible PlanetScale credential is detected.
`dlp:openclaw_gateway_token`	A possible OpenClaw gateway token is detected.

Sensitive data flows

These rules follow sensitive values as an action sends them to a destination, exposes them in output, or writes them to disk.

Rule ID	What activates the rule
`rewrite:src-sink`	Sensitive data could leave the device.
`rewrite:source_sink_flow.egress`	Sensitive data could reach a network destination.
`rewrite:source_sink_flow.exposure`	Sensitive data could appear in output.
`rewrite:source_sink_flow.write`	Sensitive data could be written to a file.
`dlp:secret_file_egress`	Sensitive file contents could leave the device; the transfer is stopped.
`dlp:env_dump_egress`	Environment data could leave the device; the transfer is stopped.
`dlp:substitution_secret_egress`	A hidden or decoded value could expose sensitive data; the transfer is stopped.
`dlp:egress_payload_secret`	A network request contains a possible secret; the request is stopped.
`dlp:secret_literal_egress`	A recognizable secret could leave the device.
`dlp:mcp_argument_secret`	A tool argument contains a possible secret.
`dlp:openclaw_integrity_secret`	A protected OpenClaw field contains a possible secret; the call is stopped without modifying its input.
`label:confidential_artifact_egress`	Confidential data targets an unapproved destination; the transfer is stopped.

Sensitive files

These rules prevent raw reads, edits, writes, and searches involving protected files. When possible, AIF offers protected or redacted output instead of exposing the raw content.

Rule ID	What activates the rule
`policy:secret_file_read`	A tool reads a sensitive file.
`policy:secret_file_read_file`	A file-reading tool accesses a sensitive file.
`policy:secret_file_fs_read`	A filesystem tool reads a sensitive file.
`policy:secret_file_search_files`	A search could expose sensitive file contents.
`policy:secret_file_edit`	A tool attempts to edit a sensitive file; the modification is stopped.
`policy:secret_file_write`	A tool attempts to write sensitive content into a protected file; the write is stopped.
`policy:secret_file_write_file`	A file-writing tool attempts to modify a sensitive file; the write is stopped.
`policy:secret_file_replace`	A replacement operation could modify a sensitive file; the change is stopped.
`policy:secret_file_fs_write`	A filesystem tool attempts to modify a sensitive file; the write is stopped.
`policy:secret_file_patch`	A patch could modify a sensitive file; the change is stopped.

Enrolled secrets

An enrolled secret is handled through AIF’s protected secret mechanism rather than shown as a raw value.

Rule ID	What activates the rule
`enroll:enrolled_native_read`	A tool reads an enrolled secret directly.
`enroll:enrolled_native_write`	A tool attempts to modify an enrolled secret directly; the write is stopped.
`enroll:enrolled_native_write_content`	An enrolled secret could be written into a file; the write is stopped.
`enroll:enrollment_gate_unlisted`	An enrolled secret targets an unapproved destination; the action pauses for approval.
`enroll:expand_wrap_unverified`	Secret expansion lacks AIF’s required protections; the action is stopped.
`enroll:enrolled_expand`	An enrolled secret targets an approved destination and is expanded only inside the protected command.
`enroll:expand_wrap_verified`	AIF verifies the protected secret-expansion wrapper and allows the action to continue.
`enroll:enrolled_tokenize`	An enrolled secret is found and is replaced with its protected handle before output is shown.

Dangerous actions

These rules stop high-impact operations before they can make broad or irreversible changes.

Rule ID	What activates the rule
`policy:curl_pipe_to_shell`	Downloaded code would run immediately.
`policy:recursive_rm_root`	Files outside the current project could be recursively deleted.
`policy:history_credential_wipe`	Shell history or credential files could be erased.
`policy:force_push_default_branch`	Shared default-branch history could be overwritten.
`policy:mkfs_device`	A storage device could be reformatted.
`policy:dd_to_device`	Raw data could overwrite a storage device.
`policy:fork_bomb`	A command could exhaust the machine’s process capacity.
`policy:chmod_world_writable`	File permissions would allow anyone to modify and execute content.
`policy:o1_deny_floor`	An irreversible action could cause widespread damage; it is blocked without an approval path.

Tool inspection

These rules apply when AIF cannot safely interpret a tool, destination, or command structure. Depending on the risk, AIF blocks or pauses the action rather than guessing.

Rule ID	What activates the rule
`routing:field_semantic_mismatch`	AIF cannot safely understand a tool’s input fields; the call is blocked without modification.
`routing:secret_reference`	An unfamiliar tool references a possible secret.
`routing:invalid_remote_url`	A network destination cannot be verified; the request is blocked.
`residue:residue_capability_reachable`	An action cannot be fully inspected and may reach sensitive data or the network; it pauses for review.
`rewrite:shell_affordance_t3`	A command is hidden inside another program; AIF stops or pauses it for review.
`label:label_lookup_unavailable`	AIF cannot verify whether data is confidential; the transfer pauses for approval.
`bands:exfil_user_requested_ask`	A user-requested sensitive transfer needs confirmation; it pauses for approval.

Safe handling

These rules document conditions under which a protected action can proceed because AIF can verify the necessary guard, role, or lack of reachable sensitive capability.

Rule ID	What activates the rule
`rewrite:verified_guard_bash`	Bash output is protected by a verified redaction guard.
`rewrite:verified_guard_python`	Python output is protected by a verified redaction guard.
`rewrite:verified_guard_node`	JavaScript output is protected by a verified redaction guard.
`roles:auth_material_position`	A credential is used only for authentication, not transferred as data.
`bands:auth_position_allow_dr1`	AIF confirms a credential is used only for authentication.
`peek:peek_cleared`	A sensitive-looking file is inspected and found clean.
`peek:peek_nonexistent`	A referenced sensitive-looking file does not exist.
`residue:residue_no_capability`	An action cannot be fully inspected but cannot reach sensitive data or the network.
`rewrite:unanalyzable_bash`	Bash content cannot be completely inspected; AIF applies the configured safe fallback.
`rewrite:unanalyzable_python`	Python content cannot be completely inspected; AIF applies the configured safe fallback.
`rewrite:unanalyzable_node`	JavaScript content cannot be completely inspected; AIF applies the configured safe fallback.

Custom rules

Organizations can extend the built-in policy set with their own policy rules and sensitive-data detectors.

Rule ID pattern	What activates the rule
`policy:<custom-rule-id>`	An organization-defined policy is matched; AIF applies that policy’s configured action.
`dlp:<custom-detector-id>`	An organization-defined sensitive-data pattern is detected; AIF applies the configured protection.

Next steps

Use aif show to inspect a recorded rule and decision locally.
Read command output to interpret aif configure, aif doctor, and aif status.
Read privacy and network for the data-handling boundaries that apply to AIF.