@iamem/amem 0.1.0

package/templates/policy.deny-default.toml

@@ -0,0 +1,20 @@
+# amem deny-by-default IT policy
+# Deploy as root-owned: /etc/amem/policy.toml
+# Memory still never leaves the laptop.
+
+telemetry = false
+ui_enabled = true
+ui_bind = "127.0.0.1"
+allow_export = false
+
+# Only the hosts you explicitly allow.
+allowed_platforms = ["cursor", "claude"]
+
+# Require a known remote prefix (uncomment and set your org).
+# allowed_remote_hosts = ["github.com/your-org"]
+
+# Extra deny regexes on top of builtin secret patterns.
+# deny_claim_patterns = ["customer[_-]?ssn"]
+
+# Empty = Memory must approve every draft. Do not auto-apply on managed fleets.
+auto_apply_kinds = []

package/templates/policy.example.toml

@@ -0,0 +1,22 @@
+# amem enterprise policy example
+# Deploy as root-owned: /etc/amem/policy.toml
+# Or set AMEM_POLICY_PATH for tests / alternate locations.
+#
+# Precedence (later wins): defaults → ~/.amem/policy.toml → /etc/amem/policy.toml → AMEM_POLICY_PATH
+# Telemetry cannot be enabled. UI bind is forced to loopback.
+
+telemetry = false
+ui_enabled = true
+ui_bind = "127.0.0.1"
+allow_export = false
+allowed_platforms = ["cursor", "claude"]
+
+# Empty = any remote. Non-empty = prefix match on normalized origin URL (no https://).
+# allowed_remote_hosts = ["github.com/your-org", "gitlab.company.internal"]
+
+# Extra deny regexes (case-insensitive). Builtin secret patterns always apply.
+# deny_claim_patterns = ["customer[_-]?ssn", "prod[_-]?password"]
+
+# Optional: auto-apply low-risk draft kinds without Memory approve (empty = never).
+# Prefer leaving this empty on managed fleets.
+# auto_apply_kinds = ["structure"]