---
title: "Security rules reference"
description: "Browse the built-in AIF rules that detect sensitive data, protect files and secrets, inspect tools, and stop dangerous actions."
---

> Documentation Index
> Fetch the complete documentation index at: https://docs.harden.run/llms.txt
> Use this file to discover all available pages before exploring further.

# Security rules reference

AIF evaluates covered agent actions against built-in rules before an action runs. A rule ID in local history is the stable explanation for why AIF allowed, redacted, paused, or blocked that action.

This reference describes the built-in rules included in the current policy set. The outcome always depends on the action's context: where data is going, whether it can be safely rewritten, and which protection policy applies.

## How to read a rule

- **Allow** means the protected action can continue.
- **Redact** means AIF replaces a sensitive value with a safe placeholder when the action can still proceed safely.
- **Ask** means AIF pauses the action for review.
- **Block** means AIF stops the action before it runs.

Use the rule ID from a local record with the [decision labels](/reference/decisions) and [local-history guide](/operations/local-history). If an outcome needs investigation, run `aif doctor` and follow the [troubleshooting guide](/operations/troubleshooting).

## Sensitive values

These detectors recognize likely access tokens, credentials, secret keys, and similar authentication material. When safe, AIF redacts the value; otherwise it stops the action.

| Rule ID | What activates the rule |
| --- | --- |
| `dlp:high_entropy_token` | A possible access token is detected. |
| `dlp:secret_key_value` | A named secret, password, credential, or API key is detected. |
| `dlp:canary_token` | A protected canary token is detected; the action is stopped. |
| `dlp:stripe_live_key` | A possible Stripe key is detected. |
| `dlp:stripe_webhook_secret` | A possible Stripe webhook secret is detected. |
| `dlp:anthropic_api_key` | A possible Anthropic API key is detected. |
| `dlp:openai_project_key` | A possible OpenAI project key is detected. |
| `dlp:openrouter_api_key` | A possible OpenRouter API key is detected. |
| `dlp:openai_key` | A possible OpenAI API key is detected. |
| `dlp:aws_access_key_id` | A possible AWS access key is detected. |
| `dlp:aws_secret_access_key` | A possible AWS secret key is detected. |
| `dlp:aws_bedrock_api_key` | A possible AWS Bedrock API key is detected. |
| `dlp:google_api_key` | A possible Google API key is detected. |
| `dlp:google_oauth_token` | A possible Google access token is detected. |
| `dlp:google_oauth_client_secret` | A possible Google OAuth client secret is detected. |
| `dlp:azure_storage_account_key` | A possible Azure storage key is detected. |
| `dlp:azure_ad_client_secret` | A possible Microsoft Entra client secret is detected. |
| `dlp:github_pat` | A possible GitHub access token is detected. |
| `dlp:github_fine_grained_pat` | A possible GitHub fine-grained token is detected. |
| `dlp:github_oauth_token` | A possible GitHub OAuth token is detected. |
| `dlp:gitlab_pat` | A possible GitLab access token is detected. |
| `dlp:huggingface_token` | A possible Hugging Face token is detected. |
| `dlp:huggingface_org_token` | A possible Hugging Face organization token is detected. |
| `dlp:slack_token` | A possible Slack token is detected. |
| `dlp:slack_app_token` | A possible Slack application token is detected. |
| `dlp:slack_webhook_url` | A possible Slack webhook is detected. |
| `dlp:pem_private_key` | A possible private key is detected. |
| `dlp:url_userinfo` | Credentials are found inside a web address. |
| `dlp:jwt` | A possible signed session token is detected. |
| `dlp:perplexity_api_key` | A possible Perplexity API key is detected. |
| `dlp:cohere_api_key` | A possible Cohere API key is detected. |
| `dlp:digitalocean_token` | A possible DigitalOcean token is detected. |
| `dlp:flyio_access_token` | A possible Fly.io access token is detected. |
| `dlp:npm_access_token` | A possible npm access token is detected. |
| `dlp:pypi_upload_token` | A possible PyPI upload token is detected. |
| `dlp:databricks_api_token` | A possible Databricks token is detected. |
| `dlp:sendgrid_api_token` | A possible SendGrid API key is detected. |
| `dlp:square_access_token` | A possible Square access token is detected. |
| `dlp:twilio_api_key` | A possible Twilio API key is detected. |
| `dlp:hashicorp_tf_api_token` | A possible Terraform Cloud token is detected. |
| `dlp:heroku_api_key` | A possible Heroku API key is detected. |
| `dlp:cloudflare_origin_ca_key` | A possible Cloudflare origin key is detected. |
| `dlp:telegram_bot_token` | A possible Telegram bot token is detected. |
| `dlp:postman_api_token` | A possible Postman API key is detected. |
| `dlp:planetscale_token` | A possible PlanetScale credential is detected. |
| `dlp:openclaw_gateway_token` | A possible OpenClaw gateway token is detected. |

## Sensitive data flows

These rules follow sensitive values as an action sends them to a destination, exposes them in output, or writes them to disk.

| Rule ID | What activates the rule |
| --- | --- |
| `rewrite:src-sink` | Sensitive data could leave the device. |
| `rewrite:source_sink_flow.egress` | Sensitive data could reach a network destination. |
| `rewrite:source_sink_flow.exposure` | Sensitive data could appear in output. |
| `rewrite:source_sink_flow.write` | Sensitive data could be written to a file. |
| `dlp:secret_file_egress` | Sensitive file contents could leave the device; the transfer is stopped. |
| `dlp:env_dump_egress` | Environment data could leave the device; the transfer is stopped. |
| `dlp:substitution_secret_egress` | A hidden or decoded value could expose sensitive data; the transfer is stopped. |
| `dlp:egress_payload_secret` | A network request contains a possible secret; the request is stopped. |
| `dlp:secret_literal_egress` | A recognizable secret could leave the device. |
| `dlp:mcp_argument_secret` | A tool argument contains a possible secret. |
| `dlp:openclaw_integrity_secret` | A protected OpenClaw field contains a possible secret; the call is stopped without modifying its input. |
| `label:confidential_artifact_egress` | Confidential data targets an unapproved destination; the transfer is stopped. |

## Sensitive files

These rules prevent raw reads, edits, writes, and searches involving protected files. When possible, AIF offers protected or redacted output instead of exposing the raw content.

| Rule ID | What activates the rule |
| --- | --- |
| `policy:secret_file_read` | A tool reads a sensitive file. |
| `policy:secret_file_read_file` | A file-reading tool accesses a sensitive file. |
| `policy:secret_file_fs_read` | A filesystem tool reads a sensitive file. |
| `policy:secret_file_search_files` | A search could expose sensitive file contents. |
| `policy:secret_file_edit` | A tool attempts to edit a sensitive file; the modification is stopped. |
| `policy:secret_file_write` | A tool attempts to write sensitive content into a protected file; the write is stopped. |
| `policy:secret_file_write_file` | A file-writing tool attempts to modify a sensitive file; the write is stopped. |
| `policy:secret_file_replace` | A replacement operation could modify a sensitive file; the change is stopped. |
| `policy:secret_file_fs_write` | A filesystem tool attempts to modify a sensitive file; the write is stopped. |
| `policy:secret_file_patch` | A patch could modify a sensitive file; the change is stopped. |

## Enrolled secrets

An enrolled secret is handled through AIF's protected secret mechanism rather than shown as a raw value.

| Rule ID | What activates the rule |
| --- | --- |
| `enroll:enrolled_native_read` | A tool reads an enrolled secret directly. |
| `enroll:enrolled_native_write` | A tool attempts to modify an enrolled secret directly; the write is stopped. |
| `enroll:enrolled_native_write_content` | An enrolled secret could be written into a file; the write is stopped. |
| `enroll:enrollment_gate_unlisted` | An enrolled secret targets an unapproved destination; the action pauses for approval. |
| `enroll:expand_wrap_unverified` | Secret expansion lacks AIF's required protections; the action is stopped. |
| `enroll:enrolled_expand` | An enrolled secret targets an approved destination and is expanded only inside the protected command. |
| `enroll:expand_wrap_verified` | AIF verifies the protected secret-expansion wrapper and allows the action to continue. |
| `enroll:enrolled_tokenize` | An enrolled secret is found and is replaced with its protected handle before output is shown. |

## Dangerous actions

These rules stop high-impact operations before they can make broad or irreversible changes.

| Rule ID | What activates the rule |
| --- | --- |
| `policy:curl_pipe_to_shell` | Downloaded code would run immediately. |
| `policy:recursive_rm_root` | Files outside the current project could be recursively deleted. |
| `policy:history_credential_wipe` | Shell history or credential files could be erased. |
| `policy:force_push_default_branch` | Shared default-branch history could be overwritten. |
| `policy:mkfs_device` | A storage device could be reformatted. |
| `policy:dd_to_device` | Raw data could overwrite a storage device. |
| `policy:fork_bomb` | A command could exhaust the machine's process capacity. |
| `policy:chmod_world_writable` | File permissions would allow anyone to modify and execute content. |
| `policy:o1_deny_floor` | An irreversible action could cause widespread damage; it is blocked without an approval path. |

## Tool inspection

These rules apply when AIF cannot safely interpret a tool, destination, or command structure. Depending on the risk, AIF blocks or pauses the action rather than guessing.

| Rule ID | What activates the rule |
| --- | --- |
| `routing:field_semantic_mismatch` | AIF cannot safely understand a tool's input fields; the call is blocked without modification. |
| `routing:secret_reference` | An unfamiliar tool references a possible secret. |
| `routing:invalid_remote_url` | A network destination cannot be verified; the request is blocked. |
| `residue:residue_capability_reachable` | An action cannot be fully inspected and may reach sensitive data or the network; it pauses for review. |
| `rewrite:shell_affordance_t3` | A command is hidden inside another program; AIF stops or pauses it for review. |
| `label:label_lookup_unavailable` | AIF cannot verify whether data is confidential; the transfer pauses for approval. |
| `bands:exfil_user_requested_ask` | A user-requested sensitive transfer needs confirmation; it pauses for approval. |

## Safe handling

These rules document conditions under which a protected action can proceed because AIF can verify the necessary guard, role, or lack of reachable sensitive capability.

| Rule ID | What activates the rule |
| --- | --- |
| `rewrite:verified_guard_bash` | Bash output is protected by a verified redaction guard. |
| `rewrite:verified_guard_python` | Python output is protected by a verified redaction guard. |
| `rewrite:verified_guard_node` | JavaScript output is protected by a verified redaction guard. |
| `roles:auth_material_position` | A credential is used only for authentication, not transferred as data. |
| `bands:auth_position_allow_dr1` | AIF confirms a credential is used only for authentication. |
| `peek:peek_cleared` | A sensitive-looking file is inspected and found clean. |
| `peek:peek_nonexistent` | A referenced sensitive-looking file does not exist. |
| `residue:residue_no_capability` | An action cannot be fully inspected but cannot reach sensitive data or the network. |
| `rewrite:unanalyzable_bash` | Bash content cannot be completely inspected; AIF applies the configured safe fallback. |
| `rewrite:unanalyzable_python` | Python content cannot be completely inspected; AIF applies the configured safe fallback. |
| `rewrite:unanalyzable_node` | JavaScript content cannot be completely inspected; AIF applies the configured safe fallback. |

## Custom rules

Organizations can extend the built-in policy set with their own policy rules and sensitive-data detectors.

| Rule ID pattern | What activates the rule |
| --- | --- |
| `policy:<custom-rule-id>` | An organization-defined policy is matched; AIF applies that policy's configured action. |
| `dlp:<custom-detector-id>` | An organization-defined sensitive-data pattern is detected; AIF applies the configured protection. |

## Next steps

- Use [`aif show`](/operations/local-history) to inspect a recorded rule and decision locally.
- Read [command output](/reference/command-output) to interpret `aif configure`, `aif doctor`, and `aif status`.
- Read [privacy and network](/operations/privacy) for the data-handling boundaries that apply to AIF.

Source: https://docs.harden.run/reference/rules/index.mdx