Security postures

Cengrid’s approach follows local coding agents such as Codex and Claude Code: the agent acts as the person it is working for, with their credentials and permissions, and everything it does is audited. An organisation picks one security posture, and narrower scopes can only tighten it.

Posture	Behaviour
Strict	Every harness tool call pauses for human approval, except the two no-effect turn enders.
Auto (default)	A classifier screens provenance-labelled external data and tool results before they reach the model. A deployment can point that at its own screening proxy.
Unrestricted	No content screening and no pauses between tool calls.

Set the posture in Governance → Security, or deploy-wide with HARNESS_SECURITY_POSTURE (unrestricted, auto or strict).

Policies that apply in every posture

The predeclared command policy, the approval rules and hard denials for things like recursive deletes or destructive SQL, applies in every posture, Unrestricted included. Tools in your deployment can add approval rules for their own commands, but a rule may only deny or require approval. It can never add an allow or loosen administrator policy.

In Slack and the web, an approval appears as Allow once or Deny, plus Allow session and Allow always unless Governance → Security → Approval grant modes disables them. Google Chat offers only Allow once and Deny. Only the person who requested the command can answer.

The Auto screen

Auto uses a built-in model classifier by default, running on the helper model described in models. To use your own screening service instead, declare one securityScreen proxy in cengrid.config.jsonc:

{
  "securityScreen": {
    "backend": "proxy",
    "provider": "acme-screen",
    "endpoint": "https://screen.example.com/classify",
    "rollout": "shadow"
  }
}

Route the token with secretEnv.core.SECURITY_SCREEN_PROXY_TOKEN, which names the secret. Its value goes in .env or your secret store, never in the config. rollout is shadow or enforce.

In enforce, an unavailable or invalid provider response fails closed.
In shadow, the built-in classifier stays authoritative and the comparison is recorded.
Shadow changes authority, not disclosure: it still sends the full screened content to your endpoint, so trust that provider with external messages, files and tool results.

The proxy receives HTTPS POSTs with the routed token in x-api-key. Inputs are capped at 16,000 characters and split into overlapping 1,600-character requests. A chunk whose score is at or above its threshold resolves to Strict, and any Strict chunk makes the whole classification Strict. The full request and response schema is in configuration.