Documentation
¶
Overview ¶
Package agentpolicy generates the AGENT-SIDE half of a run's autonomy level: the managed-settings document an agent CLI reads before it will honour — or refuse — its own launch flags. The control-plane half only constrains what POST /runs will ACCEPT; this package is the agent-side expression of a level, and is PURE — no I/O, no server state.
SECURITY invariant: documents are FROZEN LITERALS, not a struct marshalled per call — each is byte for byte the file exercised against the pinned CLI (CLAUDE_CODE_VERSION 2.1.231), and testdata/ holds the same bytes so the golden test compares against evidence, not this file's own opinion. A marshalled struct would carry an error path that fails OPEN; frozen text has none. Re-run the pinned-CLI checks on every CLI version bump — these keys are a contract with one vendor's parser, not a standard.
Index ¶
Constants ¶
const ClaudeCodeManagedSettingsPath = "/etc/claude-code/managed-settings.json"
ClaudeCodeManagedSettingsPath is where Claude Code reads its managed (enterprise-policy) settings on Linux. Two directories deep by necessity: the parent is the k8s mount point, so a file directly under /etc would mount over the image's own /etc.
Variables ¶
This section is empty.
Functions ¶
func ForAgent ¶
func ForAgent(agent string, level types.AutonomyLevel, hold bool) (path string, content []byte, ok bool)
ForAgent returns the managed-settings file a run's agent should launch under at level, or ok=false when this run gets no agent-side layer. content is the exact file body, trailing newline included. hold is whether the run is on agent-run's hold lane. ok=false is ORDINARY for any agent but claude-code, and for the two rungs that constrain nothing — not an error.
func HoldTakesOver ¶
func HoldTakesOver(level types.AutonomyLevel) bool
HoldTakesOver reports whether a hold run at level gets L1's document instead of what its level brings: no level, and the two rungs whose own answer leaves the gate unprotected (L3 no file, L2 no allowManagedPermissionRulesOnly).
Types ¶
This section is empty.
Source Files