GuardRails IDE control plane

Give every tool
only what it needs.

Select a principal, describe an action in plain language, choose how long authority lasts, and see the policy decision before a native broker exists.

Permission centerworkspace:guardrails-demo

Default deny · policy v13

Who is asking?

Authority follows the exact agent, extension, or delegated tool identity.

Choose a normalized request. Sensitive environment files remain explicitly denied.

Once-only grants are consumed after use. Session grants expire automatically.

Expires in min

Broker demonstrations

Each receipt shows what a future native broker must bind and enforce outside the untrusted process.

Filesystem brokerCanonical workspace pathNo host path or symlink escape

Network brokerExact destination + redirect recheckLoopback and metadata addresses denied

Command brokerExecutable + normalized argumentsNo inherited environment or shell expansion

Credential brokerOpaque handle + destination bindingSecret value never enters tool output

Policy templates

v12 → v13+0 grants

Audit timeline

Simulate a request to record its principal, outcome, stable policy reason, and secret-safe broker receipt.

Shipped in this preview

Principal selection, once/session/workspace scope, expiration, revocation, delegation context, and an audit timeline.

Next native milestone

A native supervisor, filesystem broker, structured-command runner, egress proxy, and opaque credential handles.

Release boundary

No broad extension compatibility claim until the Linux isolation suite proves that undeclared access fails closed.