SIDIAN LABS DRAFT STANDARD
POLICY.md
Title
Machine-Readable Context
Status
Open Specification
Format
Markdown (.md)
Version
v1.0.0-draft
Abstract
A portable, Markdown-native negative-capability manifest for AI agents. Robots don't read README.md. They need deterministic rules of engagement, context boundaries, and executable constraints. POLICY.md is the standard for declaring repository intent to autonomous agents.
Specification
Policy files are modular markdown documents that define operational constraints. They are stored in a .policy/ directory at the root of a project, or defined globally in your system directory (e.g., ~/.policy/) for cross-project rules. Agents parse these files before they are permitted to execute tools or propose changes.
# .policy/infrastructure.md
---
version: 1.0
enforcement: strict
---
# Boundaries
- Agents MAY read any file in `src/`
- Agents MUST NOT modify files in `src/core/auth/` without human review
- Agents MUST NOT run `npm publish`
# Context
The system is built on Next.js App Router. Do not use the Pages router.
Always use Tailwind CSS for styling. Do not write custom CSS.
# Verification
Before proposing a PR, agents MUST run:
`npm run lint` and `npm test`Capabilities
- ¶Machine-enforceable YAML frontmatter + Markdown body
- ¶allow / deny / require_approval actions
- ¶Condition operators (eq, neq, gt, gte, lt, lte, includes, in, notIn, exists, notExists, wildcard)
- ¶Scope targets: project, skill, agent, or department
- ¶OpenAI Codex adapter (execpolicy + guardian prompt export)
- ¶CLI for validate, check, read, init, install, sync, and list
Deployment Scenarios
Forbid agents from writing .env or secret files
Require approval before adding new dependencies
Distribute reusable guardrails across teams and repos
Inject policy context into agent system prompts