apus policy

apus policy is provided by the bundled Policy plugin. It is an enterprise conformance layer over existing Apus settings, not a second configuration system. You author requirements in policy.jsonc; Apus observes the active workspace as evidence; policy reports drift through doctor --lint. Policy does not enforce tool calls or rewrite runtime behavior at request time, and it does not attest per-agent credential stores such as apus-agent.sqlite.

Policy checks configured channels, MCP servers, model providers, network SSRF posture, ingress/channel access, Gateway exposure and node command posture, authored message-routing checks, agent workspace access, sandbox posture, data-handling posture, secret provider/auth profile posture, and governed tool metadata (the ## Tools section of AGENTS.md). Use it when a workspace needs a durable, checkable statement such as "Telegram must not be enabled" or "governed tools must declare risk and owner metadata." If you only need local behavior with no attestation or drift detection, plain config is enough.

Separately, apus agent exec applies an isolated implicit policy config for each run: the agent sandbox is off, Gateway-host execution is fully allowed, and filesystem tools are restricted to --cwd.

Detailed topics

Author a policy file

Enable the plugin and write `policy.jsonc`, with an example covering every section.

Policy rule reference

Every rule namespace, the Apus state it observes, and when to use it.

Scoped overlays

Hold named agents or channels to stricter rules than the baseline.

Run checks

`policy check`, `policy compare`, and the plugin config behind them.

Accept policy state

Evidence, attestation hashes, and `policy watch` drift detection.

Findings and repair

Every check id, what `doctor --fix` repairs, and exit codes.

Related