troxy-cli 1.21.1 → 1.22.0

package/src/data/templates.json

@@ -0,0 +1,1429 @@
+{
+  "_generated_by": "troxy-cli/scripts/export-templates.mjs, reading troxy-dashboard/index.html",
+  "_why": "Vendored copy of the dashboard's shipped policy templates. Regenerate whenever the dashboard's templates change: node scripts/export-templates.mjs ../troxy-dashboard/index.html > src/data/templates.json",
+  "templates": [
+    {
+      "label": "Block over $100",
+      "category": "Spending & transactions",
+      "domain": "payment",
+      "action": "BLOCK",
+      "conditions": [
+        {
+          "field": "amount",
+          "operator": "gt",
+          "value": "100"
+        }
+      ],
+      "or_conditions": [],
+      "desc": "Blocks any single transaction above $100. Edit the amount after adding it."
+    },
+    {
+      "label": "Notify over $50",
+      "category": "Spending & transactions",
+      "domain": "payment",
+      "action": "NOTIFY",
+      "conditions": [
+        {
+          "field": "amount",
+          "operator": "gt",
+          "value": "50"
+        }
+      ],
+      "or_conditions": [],
+      "desc": "Allows transactions over $50, but notifies you each time one happens."
+    },
+    {
+      "label": "Escalate over $200",
+      "category": "Spending & transactions",
+      "domain": "payment",
+      "action": "ESCALATE",
+      "conditions": [
+        {
+          "field": "amount",
+          "operator": "gt",
+          "value": "200"
+        }
+      ],
+      "or_conditions": [],
+      "desc": "Holds any transaction above $200 until you approve it. The agent waits."
+    },
+    {
+      "label": "Block $200/day spend",
+      "category": "Spending & transactions",
+      "domain": "payment",
+      "action": "BLOCK",
+      "conditions": [
+        {
+          "field": "spend_per_day",
+          "operator": "gt",
+          "value": "200"
+        }
+      ],
+      "or_conditions": [],
+      "desc": "Caps total daily activity. Blocks the action that would cross $200 in a rolling 24 hours."
+    },
+    {
+      "label": "Cap all agents at $1,000/month",
+      "category": "Spending & transactions",
+      "domain": "payment",
+      "action": "BLOCK",
+      "conditions": [
+        {
+          "field": "spend_per_month",
+          "operator": "gt",
+          "value": "1000"
+        }
+      ],
+      "or_conditions": [],
+      "desc": "One cap across every agent on the account, not per agent. Blocks the action that would cross $1,000 in a rolling 30 days."
+    },
+    {
+      "label": "Escalate every transaction",
+      "category": "Spending & transactions",
+      "domain": "payment",
+      "action": "ESCALATE",
+      "conditions": [],
+      "or_conditions": [],
+      "desc": "Nothing happens without you approving it first. The strictest setting, good for a new agent you do not trust yet."
+    },
+    {
+      "label": "Block a specific target domain",
+      "category": "Spending & transactions",
+      "domain": "payment",
+      "action": "BLOCK",
+      "conditions": [
+        {
+          "field": "merchant_name",
+          "operator": "contains",
+          "value": "example"
+        }
+      ],
+      "or_conditions": [],
+      "desc": "Blocks actions targeting one domain. Replace \"example\" with the domain after adding it, otherwise it matches nothing."
+    },
+    {
+      "label": "Notify on every message an agent sends",
+      "category": "Messages",
+      "domain": "comms",
+      "action": "NOTIFY",
+      "conditions": [],
+      "or_conditions": [],
+      "desc": "Emails you a copy of every send decision, on every channel. Nothing is blocked, pure visibility."
+    },
+    {
+      "label": "Escalate every message an agent sends",
+      "category": "Messages",
+      "domain": "comms",
+      "action": "ESCALATE",
+      "conditions": [],
+      "or_conditions": [],
+      "desc": "Every outgoing message waits for your approval before it is sent, whichever channel it is going out on."
+    },
+    {
+      "label": "Block an agent from sending messages",
+      "category": "Messages",
+      "domain": "comms",
+      "action": "BLOCK",
+      "conditions": [],
+      "or_conditions": [],
+      "desc": "Turns sending off entirely for the agents you pick. Nothing goes out, on any channel."
+    },
+    {
+      "label": "Escalate messages going outside your company",
+      "category": "Messages",
+      "domain": "comms",
+      "action": "ESCALATE",
+      "conditions": [
+        {
+          "field": "recipient_domain",
+          "operator": "not_contains",
+          "value": "yourcompany.com"
+        }
+      ],
+      "or_conditions": [],
+      "desc": "Internal email flows freely; anything addressed outside your domain waits for approval. Because a phone number or a chat handle has no company domain, WhatsApp, Telegram and SMS messages count as outside and will wait too. We assume the address you signed in with is your work address, so the domain is pre-filled from it. If you signed up with a personal address, change it to your real company domain before adding this, otherwise it will treat every address at your personal provider as internal."
+    },
+    {
+      "label": "Escalate anything sent on WhatsApp or Telegram",
+      "category": "Messages",
+      "domain": "comms",
+      "action": "ESCALATE",
+      "conditions": [],
+      "or_conditions": [
+        {
+          "action": "ESCALATE",
+          "conditions": [
+            {
+              "field": "channel",
+              "operator": "eq",
+              "value": "whatsapp"
+            }
+          ]
+        },
+        {
+          "action": "ESCALATE",
+          "conditions": [
+            {
+              "field": "channel",
+              "operator": "eq",
+              "value": "telegram"
+            }
+          ]
+        }
+      ],
+      "desc": "Email goes out as normal; anything the agent tries to send on WhatsApp or Telegram waits for you. A good first rule if you have just connected an agent to a personal messaging account, where there is no sent folder to check afterwards."
+    },
+    {
+      "label": "Block the agent from messaging apps",
+      "category": "Messages",
+      "domain": "comms",
+      "action": "BLOCK",
+      "conditions": [],
+      "or_conditions": [
+        {
+          "action": "BLOCK",
+          "conditions": [
+            {
+              "field": "channel",
+              "operator": "eq",
+              "value": "whatsapp"
+            }
+          ]
+        },
+        {
+          "action": "BLOCK",
+          "conditions": [
+            {
+              "field": "channel",
+              "operator": "eq",
+              "value": "telegram"
+            }
+          ]
+        },
+        {
+          "action": "BLOCK",
+          "conditions": [
+            {
+              "field": "channel",
+              "operator": "eq",
+              "value": "sms"
+            }
+          ]
+        },
+        {
+          "action": "BLOCK",
+          "conditions": [
+            {
+              "field": "channel",
+              "operator": "eq",
+              "value": "discord"
+            }
+          ]
+        }
+      ],
+      "desc": "The agent can still send email, but never a WhatsApp, Telegram, SMS or Discord message. For when an agent has a job that email covers completely and there is no reason for it to reach your personal contacts."
+    },
+    {
+      "label": "Block outgoing messages mentioning a password",
+      "category": "Messages",
+      "domain": "comms",
+      "action": "BLOCK",
+      "conditions": [
+        {
+          "field": "body",
+          "operator": "contains",
+          "value": "password"
+        }
+      ],
+      "or_conditions": [],
+      "desc": "Reads the message body and blocks it if the word \"password\" appears anywhere in the text, on any channel."
+    },
+    {
+      "label": "Block a credential in any outgoing message",
+      "category": "Messages",
+      "domain": "comms",
+      "action": "BLOCK",
+      "conditions": [],
+      "or_conditions": [
+        {
+          "action": "BLOCK",
+          "conditions": [
+            {
+              "field": "body",
+              "operator": "contains",
+              "value": "api key"
+            }
+          ]
+        },
+        {
+          "action": "BLOCK",
+          "conditions": [
+            {
+              "field": "body",
+              "operator": "contains",
+              "value": "txy-"
+            }
+          ]
+        },
+        {
+          "action": "BLOCK",
+          "conditions": [
+            {
+              "field": "body",
+              "operator": "contains",
+              "value": "sk-ant-"
+            }
+          ]
+        },
+        {
+          "action": "BLOCK",
+          "conditions": [
+            {
+              "field": "body",
+              "operator": "contains",
+              "value": "ghp_"
+            }
+          ]
+        },
+        {
+          "action": "BLOCK",
+          "conditions": [
+            {
+              "field": "body",
+              "operator": "contains",
+              "value": "AKIA"
+            }
+          ]
+        },
+        {
+          "action": "BLOCK",
+          "conditions": [
+            {
+              "field": "body",
+              "operator": "contains",
+              "value": "xoxb-"
+            }
+          ]
+        },
+        {
+          "action": "BLOCK",
+          "conditions": [
+            {
+              "field": "body",
+              "operator": "contains",
+              "value": "-----BEGIN"
+            }
+          ]
+        }
+      ],
+      "desc": "Reads the message body and blocks it if it contains a credential: the words \"api key\", or a key that starts like a Troxy, Anthropic, GitHub, AWS or Slack one, or a PEM private key or certificate. Works the same whether the agent is sending an email or pasting into a WhatsApp thread. Add your own prefixes after creating it."
+    },
+    {
+      "label": "Escalate a message marked confidential",
+      "category": "Messages",
+      "domain": "comms",
+      "action": "ESCALATE",
+      "conditions": [
+        {
+          "field": "body",
+          "operator": "contains",
+          "value": "confidential"
+        }
+      ],
+      "or_conditions": [],
+      "desc": "Holds any message whose body contains the word \"confidential\" until you approve it. Sending confidential material to a colleague is ordinary work, so this asks rather than refuses."
+    },
+    {
+      "label": "Escalate mass sends (reply-all or bulk)",
+      "category": "Messages",
+      "domain": "comms",
+      "action": "ESCALATE",
+      "conditions": [
+        {
+          "field": "recipient_count",
+          "operator": "gt",
+          "value": "5"
+        }
+      ],
+      "or_conditions": [],
+      "desc": "Counts every To, Cc and Bcc address, or every member of a group thread. More than 5 people and the send waits for your approval."
+    },
+    {
+      "label": "Block messages to personal email domains",
+      "category": "Messages",
+      "domain": "comms",
+      "action": "BLOCK",
+      "conditions": [],
+      "or_conditions": [
+        {
+          "action": "BLOCK",
+          "conditions": [
+            {
+              "field": "recipient_domain",
+              "operator": "contains",
+              "value": "gmail.com"
+            }
+          ]
+        },
+        {
+          "action": "BLOCK",
+          "conditions": [
+            {
+              "field": "recipient_domain",
+              "operator": "contains",
+              "value": "yahoo.com"
+            }
+          ]
+        },
+        {
+          "action": "BLOCK",
+          "conditions": [
+            {
+              "field": "recipient_domain",
+              "operator": "contains",
+              "value": "outlook.com"
+            }
+          ]
+        },
+        {
+          "action": "BLOCK",
+          "conditions": [
+            {
+              "field": "recipient_domain",
+              "operator": "contains",
+              "value": "hotmail.com"
+            }
+          ]
+        }
+      ],
+      "desc": "Stops an agent from sending emails to personal email providers. Prevents data exfiltration to a personal account - the agent can still email colleagues at your company domain. Add other personal providers as branches after adding it."
+    },
+    {
+      "label": "Escalate making a file public",
+      "category": "Files & documents",
+      "domain": "destructive",
+      "action": "ESCALATE",
+      "conditions": [
+        {
+          "field": "action_verb",
+          "operator": "eq",
+          "value": "share"
+        },
+        {
+          "field": "destination",
+          "operator": "eq",
+          "value": "public"
+        }
+      ],
+      "or_conditions": [],
+      "desc": "Sharing a doc with a named person goes through. Turning on \"anyone with the link\", or making it public, waits for you. Publishing something deliberately is a real thing people do, so this asks rather than refuses."
+    },
+    {
+      "label": "Escalate sharing a file outside your company",
+      "category": "Files & documents",
+      "domain": "destructive",
+      "action": "ESCALATE",
+      "conditions": [],
+      "or_conditions": [
+        {
+          "action": "ESCALATE",
+          "conditions": [
+            {
+              "field": "action_verb",
+              "operator": "eq",
+              "value": "share"
+            },
+            {
+              "field": "destination",
+              "operator": "eq",
+              "value": "public"
+            }
+          ]
+        },
+        {
+          "action": "ESCALATE",
+          "conditions": [
+            {
+              "field": "action_verb",
+              "operator": "eq",
+              "value": "share"
+            },
+            {
+              "field": "destination",
+              "operator": "contains",
+              "value": "@"
+            },
+            {
+              "field": "destination",
+              "operator": "not_contains",
+              "value": "yourcompany.com"
+            }
+          ]
+        }
+      ],
+      "desc": "Sharing with a colleague is unrestricted. Making a file public, or sharing it with an address outside your company, waits for your approval. Uploading a file to your own storage is not a share and will not trigger this. Pre-filled with the domain you signed in with, editable after adding."
+    },
+    {
+      "label": "Escalate a delete that cannot be undone",
+      "category": "Files & documents",
+      "domain": "destructive",
+      "action": "ESCALATE",
+      "conditions": [
+        {
+          "field": "action_verb",
+          "operator": "eq",
+          "value": "delete"
+        },
+        {
+          "field": "reversible",
+          "operator": "eq",
+          "value": "false"
+        }
+      ],
+      "or_conditions": [],
+      "desc": "Moving a file to the trash is recoverable and goes through. Emptying the trash, or a permanent delete that skips it, waits for you. Covers the case where the agent itself has told us the action is irreversible."
+    },
+    {
+      "label": "Notify when files are exported or downloaded",
+      "category": "Files & documents",
+      "domain": "destructive",
+      "action": "NOTIFY",
+      "conditions": [
+        {
+          "field": "action_verb",
+          "operator": "eq",
+          "value": "export"
+        }
+      ],
+      "or_conditions": [],
+      "desc": "Nothing is blocked. You get an email whenever the agent pulls files or records out of a system, including a bulk download of a folder. Pair it with the bulk-export rule under Data & privacy if you want large ones to actually wait."
+    },
+    {
+      "label": "Escalate every signup",
+      "category": "Data & privacy",
+      "domain": "access",
+      "action": "ESCALATE",
+      "conditions": [
+        {
+          "field": "login_action",
+          "operator": "eq",
+          "value": "signup"
+        }
+      ],
+      "or_conditions": [],
+      "desc": "The agent must get your approval before creating an account anywhere."
+    },
+    {
+      "label": "Notify on every login",
+      "category": "Data & privacy",
+      "domain": "access",
+      "action": "NOTIFY",
+      "conditions": [
+        {
+          "field": "login_action",
+          "operator": "eq",
+          "value": "login"
+        }
+      ],
+      "or_conditions": [],
+      "desc": "Logging in is allowed, but you get an email showing which site each time."
+    },
+    {
+      "label": "Never let the agent create accounts",
+      "category": "Data & privacy",
+      "domain": "access",
+      "action": "BLOCK",
+      "conditions": [
+        {
+          "field": "login_action",
+          "operator": "eq",
+          "value": "signup"
+        }
+      ],
+      "or_conditions": [],
+      "desc": "A hard stop on signups. The agent can log into accounts you already have, but can never create a new one."
+    },
+    {
+      "label": "Escalate access to a specific site",
+      "category": "Data & privacy",
+      "domain": "access",
+      "action": "ESCALATE",
+      "conditions": [
+        {
+          "field": "site",
+          "operator": "contains",
+          "value": "example.com"
+        }
+      ],
+      "or_conditions": [],
+      "desc": "Gates one site by name. Replace \"example.com\" after adding it, otherwise it matches nothing."
+    },
+    {
+      "label": "Escalate bank or card details in a message",
+      "category": "Data & privacy",
+      "domain": "comms",
+      "action": "ESCALATE",
+      "conditions": [],
+      "or_conditions": [
+        {
+          "action": "ESCALATE",
+          "conditions": [
+            {
+              "field": "body",
+              "operator": "contains",
+              "value": "card number"
+            }
+          ]
+        },
+        {
+          "action": "ESCALATE",
+          "conditions": [
+            {
+              "field": "body",
+              "operator": "contains",
+              "value": "cvv"
+            }
+          ]
+        },
+        {
+          "action": "ESCALATE",
+          "conditions": [
+            {
+              "field": "body",
+              "operator": "contains",
+              "value": "iban"
+            }
+          ]
+        },
+        {
+          "action": "ESCALATE",
+          "conditions": [
+            {
+              "field": "body",
+              "operator": "contains",
+              "value": "routing number"
+            }
+          ]
+        },
+        {
+          "action": "ESCALATE",
+          "conditions": [
+            {
+              "field": "body",
+              "operator": "contains",
+              "value": "sort code"
+            }
+          ]
+        },
+        {
+          "action": "ESCALATE",
+          "conditions": [
+            {
+              "field": "body",
+              "operator": "contains",
+              "value": "account number"
+            }
+          ]
+        }
+      ],
+      "desc": "Holds any message whose body mentions bank or card details until you approve it, on email or a messaging app. Matches the words around the number rather than the number itself, so an agent that pastes a bare 16 digits with no label will not be caught. Add your own phrases after adding it."
+    },
+    {
+      "label": "Escalate an ID or passport number in a message",
+      "category": "Data & privacy",
+      "domain": "comms",
+      "action": "ESCALATE",
+      "conditions": [],
+      "or_conditions": [
+        {
+          "action": "ESCALATE",
+          "conditions": [
+            {
+              "field": "body",
+              "operator": "contains",
+              "value": "passport number"
+            }
+          ]
+        },
+        {
+          "action": "ESCALATE",
+          "conditions": [
+            {
+              "field": "body",
+              "operator": "contains",
+              "value": "social security"
+            }
+          ]
+        },
+        {
+          "action": "ESCALATE",
+          "conditions": [
+            {
+              "field": "body",
+              "operator": "contains",
+              "value": "national id"
+            }
+          ]
+        },
+        {
+          "action": "ESCALATE",
+          "conditions": [
+            {
+              "field": "body",
+              "operator": "contains",
+              "value": "date of birth"
+            }
+          ]
+        }
+      ],
+      "desc": "Government ID and date of birth are the details that make everything else easier to steal, so this asks you before any of them go out. Same substring caveat as the bank rule: it matches the label, not the number."
+    },
+    {
+      "label": "Escalate sharing anywhere you have not approved",
+      "category": "Data & privacy",
+      "domain": "destructive",
+      "action": "ESCALATE",
+      "conditions": [],
+      "or_conditions": [
+        {
+          "action": "ESCALATE",
+          "conditions": [
+            {
+              "field": "action_verb",
+              "operator": "eq",
+              "value": "share"
+            },
+            {
+              "field": "destination",
+              "operator": "eq",
+              "value": "public"
+            }
+          ]
+        },
+        {
+          "action": "ESCALATE",
+          "conditions": [
+            {
+              "field": "action_verb",
+              "operator": "eq",
+              "value": "share"
+            },
+            {
+              "field": "destination",
+              "operator": "contains",
+              "value": "@"
+            },
+            {
+              "field": "destination",
+              "operator": "not_contains",
+              "value": "yourcompany.com"
+            }
+          ]
+        }
+      ],
+      "desc": "An allowlist. Anything made public, or shared with a person outside the domain named here, waits for your approval. Starts with your own company domain; add a branch per service or domain you want to treat as approved. Storing a file in your own Drive is not a share and will not trigger this."
+    },
+    {
+      "label": "Escalate a bulk data export",
+      "category": "Data & privacy",
+      "domain": "destructive",
+      "action": "ESCALATE",
+      "conditions": [
+        {
+          "field": "action_verb",
+          "operator": "eq",
+          "value": "export"
+        },
+        {
+          "field": "item_count",
+          "operator": "gt",
+          "value": "100"
+        }
+      ],
+      "or_conditions": [],
+      "desc": "A small export goes through; anything over 100 records waits for you. Edit the threshold after adding it."
+    },
+    {
+      "label": "Block exporting customer data",
+      "category": "Data & privacy",
+      "domain": "destructive",
+      "action": "BLOCK",
+      "conditions": [
+        {
+          "field": "action_verb",
+          "operator": "eq",
+          "value": "export"
+        },
+        {
+          "field": "resource",
+          "operator": "contains",
+          "value": "customer"
+        }
+      ],
+      "or_conditions": [],
+      "desc": "A hard stop on exporting any data from a customer, user, or PII store. The agent can export other datasets freely, but customer data does not leave without this rule being removed."
+    },
+    {
+      "label": "Escalate access to social media",
+      "category": "Data & privacy",
+      "domain": "access",
+      "action": "ESCALATE",
+      "conditions": [],
+      "or_conditions": [
+        {
+          "action": "ESCALATE",
+          "conditions": [
+            {
+              "field": "site",
+              "operator": "contains",
+              "value": "twitter.com"
+            }
+          ]
+        },
+        {
+          "action": "ESCALATE",
+          "conditions": [
+            {
+              "field": "site",
+              "operator": "contains",
+              "value": "facebook.com"
+            }
+          ]
+        },
+        {
+          "action": "ESCALATE",
+          "conditions": [
+            {
+              "field": "site",
+              "operator": "contains",
+              "value": "instagram.com"
+            }
+          ]
+        },
+        {
+          "action": "ESCALATE",
+          "conditions": [
+            {
+              "field": "site",
+              "operator": "contains",
+              "value": "linkedin.com"
+            }
+          ]
+        },
+        {
+          "action": "ESCALATE",
+          "conditions": [
+            {
+              "field": "site",
+              "operator": "contains",
+              "value": "tiktok.com"
+            }
+          ]
+        }
+      ],
+      "desc": "Any login or signup on a social media platform waits for your approval. Stops an agent from quietly connecting to social accounts on your behalf. Add more domains as branches after adding it."
+    },
+    {
+      "label": "Block API keys in agent output",
+      "category": "Secrets & credentials",
+      "domain": "secrets",
+      "action": "BLOCK",
+      "conditions": [
+        {
+          "field": "has_api_key",
+          "operator": "eq",
+          "value": "true"
+        }
+      ],
+      "or_conditions": [],
+      "desc": "Stops an agent from sending, writing, or publishing content that contains an API key (AWS, Stripe, GitHub, Google, Slack, OpenAI and more). The most important guardrail - credentials in the wild are how breaches happen."
+    },
+    {
+      "label": "Block credit cards and private keys",
+      "category": "Secrets & credentials",
+      "domain": "secrets",
+      "action": "BLOCK",
+      "conditions": [],
+      "or_conditions": [
+        {
+          "action": "BLOCK",
+          "conditions": [
+            {
+              "field": "has_credit_card",
+              "operator": "eq",
+              "value": "true"
+            }
+          ]
+        },
+        {
+          "action": "BLOCK",
+          "conditions": [
+            {
+              "field": "has_private_key",
+              "operator": "eq",
+              "value": "true"
+            }
+          ]
+        }
+      ],
+      "desc": "Catches credit card numbers and RSA/EC/DSA/SSH/PGP private keys before they leave the agent."
+    },
+    {
+      "label": "Escalate when any sensitive data is detected",
+      "category": "Secrets & credentials",
+      "domain": "secrets",
+      "action": "ESCALATE",
+      "conditions": [
+        {
+          "field": "has_sensitive_data",
+          "operator": "eq",
+          "value": "true"
+        }
+      ],
+      "or_conditions": [],
+      "desc": "Pauses and asks you before any content containing sensitive data (API keys, tokens, credit cards, SSNs, database connection strings, JWTs) is sent. The broadest safety net."
+    },
+    {
+      "label": "Notify on secrets in agent output",
+      "category": "Secrets & credentials",
+      "domain": "secrets",
+      "action": "NOTIFY",
+      "conditions": [
+        {
+          "field": "has_sensitive_data",
+          "operator": "eq",
+          "value": "true"
+        }
+      ],
+      "or_conditions": [],
+      "desc": "Lets everything through but emails you whenever a secret is detected in agent output. Use this when you want visibility without blocking."
+    },
+    {
+      "label": "Block a secret going somewhere public",
+      "category": "Secrets & credentials",
+      "domain": "secrets",
+      "action": "BLOCK",
+      "conditions": [
+        {
+          "field": "has_sensitive_data",
+          "operator": "eq",
+          "value": "true"
+        },
+        {
+          "field": "is_public",
+          "operator": "eq",
+          "value": "true"
+        }
+      ],
+      "or_conditions": [],
+      "desc": "A secret shared with one named colleague is ordinary work; the same secret made public, or pushed to a public repo, is an incident with no acceptable version. BLOCK is right here in a way it is not for the broader escalate-on-any-secret rule above."
+    },
+    {
+      "label": "Escalate credential rotation",
+      "category": "Secrets & credentials",
+      "domain": "destructive",
+      "action": "ESCALATE",
+      "conditions": [
+        {
+          "field": "action_verb",
+          "operator": "eq",
+          "value": "rotate"
+        }
+      ],
+      "or_conditions": [],
+      "desc": "Rotating a key is sometimes exactly the right move and sometimes breaks every system still holding the old one, so this asks you first rather than deciding for you."
+    },
+    {
+      "label": "Escalate personal data in agent output",
+      "category": "Secrets & credentials",
+      "domain": "secrets",
+      "action": "ESCALATE",
+      "conditions": [
+        {
+          "field": "has_pii",
+          "operator": "eq",
+          "value": "true"
+        }
+      ],
+      "or_conditions": [],
+      "desc": "Social security numbers and similar personal identifiers are scored high severity, so with no rule at all they are blocked outright. That is often too blunt: a support agent quoting a customer's details back to them is doing its job. This softens PII specifically to a hold-and-ask, without loosening anything else. Use it if you handle customer data and want a person to look rather than a wall."
+    },
+    {
+      "label": "Block a password in agent output",
+      "category": "Secrets & credentials",
+      "domain": "secrets",
+      "action": "BLOCK",
+      "conditions": [
+        {
+          "field": "has_password",
+          "operator": "eq",
+          "value": "true"
+        }
+      ],
+      "or_conditions": [],
+      "desc": "A password in a config line scores medium, which by default only escalates and waits. This makes it a hard stop instead. Worth having if your agents touch config files or deployment scripts, where a password reaching a log or a message is not something you want to be asked about at 2am."
+    },
+    {
+      "label": "Block database URLs and auth tokens",
+      "category": "Secrets & credentials",
+      "domain": "secrets",
+      "action": "BLOCK",
+      "conditions": [],
+      "or_conditions": [
+        {
+          "action": "BLOCK",
+          "conditions": [
+            {
+              "field": "has_connection_string",
+              "operator": "eq",
+              "value": "true"
+            }
+          ]
+        },
+        {
+          "action": "BLOCK",
+          "conditions": [
+            {
+              "field": "has_jwt",
+              "operator": "eq",
+              "value": "true"
+            }
+          ]
+        }
+      ],
+      "desc": "A postgres:// or mongodb:// URL carries its own username and password, and a JWT is a working session until it expires - both are credentials that happen not to look like one. Named separately from the API key rule because these are the two people most often forget to treat as secrets."
+    },
+    {
+      "label": "Escalate secrets in code being pushed",
+      "category": "Secrets & credentials",
+      "domain": "secrets",
+      "action": "ESCALATE",
+      "conditions": [
+        {
+          "field": "has_sensitive_data",
+          "operator": "eq",
+          "value": "true"
+        },
+        {
+          "field": "content_type",
+          "operator": "eq",
+          "value": "code"
+        }
+      ],
+      "or_conditions": [],
+      "desc": "A secret in a message is usually a mistake you can retract. A secret committed into code outlives the conversation and follows the repository around, including into every clone and every branch. This narrows to that case, so you can be stricter about code without escalating every ordinary message."
+    },
+    {
+      "label": "Escalate several secrets found at once",
+      "category": "Secrets & credentials",
+      "domain": "secrets",
+      "action": "ESCALATE",
+      "conditions": [
+        {
+          "field": "detection_count",
+          "operator": "gt",
+          "value": "2"
+        }
+      ],
+      "or_conditions": [],
+      "desc": "One key in a message is usually a slip. Three or more in a single payload usually means a whole config file, an environment dump, or a credential store went out by accident - a different and worse event. Nothing else looks at how many were found; severity only reports the worst single one."
+    },
+    {
+      "label": "Block anything high severity",
+      "category": "Secrets & credentials",
+      "domain": "secrets",
+      "action": "BLOCK",
+      "conditions": [
+        {
+          "field": "highest_severity",
+          "operator": "eq",
+          "value": "high"
+        }
+      ],
+      "or_conditions": [],
+      "desc": "This is what already happens when no other rule matches, written down as a rule you can see and change. Worth adding precisely because the built-in behaviour is invisible: with this in your list you can read it, reorder it, loosen it to ESCALATE, or scope it to particular agents. Without it, the same outcome happens with nothing on the page explaining why."
+    },
+    {
+      "label": "Escalate a new OAuth connection",
+      "category": "Access & permissions",
+      "domain": "destructive",
+      "action": "ESCALATE",
+      "conditions": [
+        {
+          "field": "action_verb",
+          "operator": "eq",
+          "value": "grant_access"
+        }
+      ],
+      "or_conditions": [],
+      "desc": "Before the agent lets an app or service into one of your accounts, it waits for you. This is the one that stops a quiet permission grant becoming permanent."
+    },
+    {
+      "label": "Notify when the agent shares or uploads a file",
+      "category": "Access & permissions",
+      "domain": "destructive",
+      "action": "NOTIFY",
+      "conditions": [
+        {
+          "field": "action_verb",
+          "operator": "eq",
+          "value": "share"
+        }
+      ],
+      "or_conditions": [],
+      "desc": "Nothing is blocked. You get an email whenever the agent shares something or puts a file somewhere, including into your own Drive. The broadest visibility rule for files; use the Files & documents templates if you want only outward sharing."
+    },
+    {
+      "label": "Escalate adding a new admin or user",
+      "category": "Access & permissions",
+      "domain": "destructive",
+      "action": "ESCALATE",
+      "conditions": [
+        {
+          "field": "action_verb",
+          "operator": "eq",
+          "value": "add_user"
+        }
+      ],
+      "or_conditions": [],
+      "desc": "Any change that gives another person access to a system waits for your approval first."
+    },
+    {
+      "label": "Block changes to billing settings",
+      "category": "Access & permissions",
+      "domain": "destructive",
+      "action": "BLOCK",
+      "conditions": [
+        {
+          "field": "action_verb",
+          "operator": "eq",
+          "value": "modify"
+        },
+        {
+          "field": "resource",
+          "operator": "contains",
+          "value": "billing"
+        }
+      ],
+      "or_conditions": [],
+      "desc": "A hard stop on the agent editing billing or plan settings. Other modifications go through, only billing is off limits."
+    },
+    {
+      "label": "Never use a specific model",
+      "category": "AI & models",
+      "domain": "model",
+      "action": "BLOCK",
+      "conditions": [
+        {
+          "field": "model",
+          "operator": "contains",
+          "value": "fable"
+        }
+      ],
+      "or_conditions": [],
+      "desc": "A hard stop on one model. Matches on part of the name, so it keeps working when the version number changes. Replace \"fable\" with the model you want to rule out. BLOCK is right here because you have already made the decision: this agent does not run on that model."
+    },
+    {
+      "label": "Escalate an expensive single run",
+      "category": "AI & models",
+      "domain": "model",
+      "action": "ESCALATE",
+      "conditions": [
+        {
+          "field": "estimated_cost",
+          "operator": "gt",
+          "value": "5"
+        }
+      ],
+      "or_conditions": [],
+      "desc": "The agent tells Troxy what it expects a piece of work to cost before starting. Anything over the threshold waits for you. Good for the case where an agent quietly decides a job needs a hundred times more thinking than usual."
+    },
+    {
+      "label": "Cap AI spend at $50 a day",
+      "category": "AI & models",
+      "domain": "model",
+      "action": "BLOCK",
+      "conditions": [
+        {
+          "field": "cost_per_day",
+          "operator": "gt",
+          "value": "50"
+        }
+      ],
+      "or_conditions": [],
+      "desc": "A rolling 24 hour ceiling on what this agent costs to run. Blocks the run that would cross the line, not the one after it. Counts only what the agent reports, so treat it as a strong brake rather than a guarantee."
+    },
+    {
+      "label": "Escalate at 1 million tokens a day",
+      "category": "AI & models",
+      "domain": "model",
+      "action": "ESCALATE",
+      "conditions": [
+        {
+          "field": "tokens_per_day",
+          "operator": "gt",
+          "value": "1000000"
+        }
+      ],
+      "or_conditions": [],
+      "desc": "Same rolling window, counted in tokens instead of dollars. Escalates rather than blocks, because a heavy day is sometimes exactly what you asked for and you are the one who can tell."
+    },
+    {
+      "label": "Notify on a runaway loop",
+      "category": "AI & models",
+      "domain": "model",
+      "action": "NOTIFY",
+      "conditions": [
+        {
+          "field": "model_calls_per_hour",
+          "operator": "gt",
+          "value": "100"
+        }
+      ],
+      "or_conditions": [],
+      "desc": "The rule with the best chance of catching an agent stuck in a loop. Each individual call looks cheap and reasonable; the rate is what gives it away. Set to notify so it stays out of the way until something is genuinely wrong."
+    },
+    {
+      "label": "Escalate an unapproved provider",
+      "category": "AI & models",
+      "domain": "model",
+      "action": "ESCALATE",
+      "conditions": [
+        {
+          "field": "provider",
+          "operator": "neq",
+          "value": "anthropic"
+        }
+      ],
+      "or_conditions": [],
+      "desc": "For when you care where your data is processed as much as what it costs. Anything running outside the provider you named waits for your approval. Edit the provider after adding it."
+    },
+    {
+      "label": "Escalate an expensive model on a big job",
+      "category": "AI & models",
+      "domain": "model",
+      "action": "ESCALATE",
+      "conditions": [
+        {
+          "field": "model",
+          "operator": "contains",
+          "value": "opus"
+        },
+        {
+          "field": "estimated_cost",
+          "operator": "gt",
+          "value": "2"
+        }
+      ],
+      "or_conditions": [],
+      "desc": "Two conditions, so a quick question on a strong model still goes through and only a long job on it waits for you. The shape to copy when you want a rule that stays quiet during normal work."
+    },
+    {
+      "label": "Notify on every model call",
+      "category": "AI & models",
+      "domain": "model",
+      "action": "NOTIFY",
+      "conditions": [],
+      "or_conditions": [],
+      "desc": "Nothing is blocked. You get an email every time the agent calls a model, whichever provider or model it is. Pure visibility for a new agent you are still evaluating."
+    },
+    {
+      "label": "Escalate at $200/month in AI spend",
+      "category": "AI & models",
+      "domain": "model",
+      "action": "ESCALATE",
+      "conditions": [
+        {
+          "field": "cost_per_month",
+          "operator": "gt",
+          "value": "200"
+        }
+      ],
+      "or_conditions": [],
+      "desc": "A rolling 30-day ceiling, same as the daily cap but monthly. Escalates rather than blocks - a heavy month is sometimes a big project, not a problem. Edit the amount after adding it."
+    },
+    {
+      "label": "Escalate large token counts per call",
+      "category": "AI & models",
+      "domain": "model",
+      "action": "ESCALATE",
+      "conditions": [
+        {
+          "field": "tokens",
+          "operator": "gt",
+          "value": "50000"
+        }
+      ],
+      "or_conditions": [],
+      "desc": "Flags any single model call that uses more than 50K tokens. Usually means the agent is stuffing a huge context window - sometimes that is real work, sometimes it is waste. This asks you which."
+    },
+    {
+      "label": "Block models over $10/MTok output",
+      "category": "AI & models",
+      "domain": "model",
+      "action": "BLOCK",
+      "conditions": [
+        {
+          "field": "output_price",
+          "operator": "gt",
+          "value": "10"
+        }
+      ],
+      "or_conditions": [],
+      "desc": "A price ceiling. Blocks any model that costs more than $10 per million output tokens, which rules out the most expensive tier (GPT-4, Opus) while allowing mid-tier models. Edit the threshold after adding it."
+    },
+    {
+      "label": "Force a cheaper model for routine work",
+      "category": "AI & models",
+      "domain": "model",
+      "action": "BLOCK",
+      "conditions": [
+        {
+          "field": "estimated_cost",
+          "operator": "lt",
+          "value": "0.50"
+        },
+        {
+          "field": "output_price",
+          "operator": "gt",
+          "value": "5"
+        }
+      ],
+      "or_conditions": [],
+      "desc": "If a job is cheap (under 50 cents), block it from running on an expensive model. Lets big jobs use premium models while routine tasks fall back to something affordable. The shape of a smart default."
+    },
+    {
+      "label": "Notify on any call over 10K tokens",
+      "category": "AI & models",
+      "domain": "model",
+      "action": "NOTIFY",
+      "conditions": [
+        {
+          "field": "tokens",
+          "operator": "gt",
+          "value": "10000"
+        }
+      ],
+      "or_conditions": [],
+      "desc": "A lighter version of the 50K rule. Nothing is blocked, but you see every call that uses a meaningful amount of context. Good early in the debugging phase with a new agent."
+    },
+    {
+      "label": "Escalate anything that cannot be undone",
+      "category": "Destructive actions",
+      "domain": "destructive",
+      "action": "ESCALATE",
+      "conditions": [
+        {
+          "field": "reversible",
+          "operator": "eq",
+          "value": "false"
+        }
+      ],
+      "or_conditions": [],
+      "desc": "The broadest safety net. Anything the agent cannot straightforwardly undo waits for you, including actions it did not label as reversible."
+    },
+    {
+      "label": "Escalate deleting more than 10 items",
+      "category": "Destructive actions",
+      "domain": "destructive",
+      "action": "ESCALATE",
+      "conditions": [
+        {
+          "field": "action_verb",
+          "operator": "eq",
+          "value": "delete"
+        },
+        {
+          "field": "item_count",
+          "operator": "gt",
+          "value": "10"
+        }
+      ],
+      "or_conditions": [],
+      "desc": "Small deletes go through; a bulk delete of more than 10 files or records waits for your approval."
+    },
+    {
+      "label": "Escalate dropping a database table",
+      "category": "Destructive actions",
+      "domain": "destructive",
+      "action": "ESCALATE",
+      "conditions": [
+        {
+          "field": "action_verb",
+          "operator": "eq",
+          "value": "drop"
+        }
+      ],
+      "or_conditions": [],
+      "desc": "Holds any drop of a table or schema until you approve it."
+    },
+    {
+      "label": "Escalate destroying cloud infrastructure",
+      "category": "Destructive actions",
+      "domain": "destructive",
+      "action": "ESCALATE",
+      "conditions": [
+        {
+          "field": "action_verb",
+          "operator": "eq",
+          "value": "destroy"
+        }
+      ],
+      "or_conditions": [],
+      "desc": "Tearing down servers, buckets or other infrastructure waits for you. Sometimes you genuinely want staging gone, so this asks instead of refusing, which would only teach you to switch the policy off."
+    },
+    {
+      "label": "Escalate a force-push to main",
+      "category": "Destructive actions",
+      "domain": "destructive",
+      "action": "ESCALATE",
+      "conditions": [
+        {
+          "field": "action_verb",
+          "operator": "eq",
+          "value": "force_push"
+        },
+        {
+          "field": "resource",
+          "operator": "contains",
+          "value": "main"
+        }
+      ],
+      "or_conditions": [],
+      "desc": "Force-pushing a feature branch is fine; force-pushing anything named main waits for you."
+    },
+    {
+      "label": "Notify on every destructive action",
+      "category": "Destructive actions",
+      "domain": "destructive",
+      "action": "NOTIFY",
+      "conditions": [],
+      "or_conditions": [],
+      "desc": "Nothing is blocked. You get an email each time the agent deletes, drops or overwrites anything."
+    },
+    {
+      "label": "Block all destructive actions",
+      "category": "Destructive actions",
+      "domain": "destructive",
+      "action": "BLOCK",
+      "conditions": [],
+      "or_conditions": [],
+      "desc": "The strictest setting. Nothing destructive goes through - no deletes, drops, destroys, or overwrites. Use this for a new agent you do not trust yet, then relax to escalate once you know what it does."
+    },
+    {
+      "label": "Escalate overwriting existing files",
+      "category": "Destructive actions",
+      "domain": "destructive",
+      "action": "ESCALATE",
+      "conditions": [
+        {
+          "field": "action_verb",
+          "operator": "eq",
+          "value": "overwrite"
+        }
+      ],
+      "or_conditions": [],
+      "desc": "Overwriting a file is scarier than deleting one - a delete can be undone, a replace silently puts wrong content where right content was. This asks before any overwrite goes through."
+    }
+  ]
+}