The policy engine

How sensitive, infrastructure, and denied paths are classified.

Three tiers of path rules

Every project has three tiers: sensitive paths (always escalated to a human, regardless of confidence), infrastructure paths (eligible for fast-track approval), and denied paths (refused outright, before any pull request is opened).

Example configuration

Each rule is a path prefix or an exact path. A denied-paths list covering a schema file and an auth module looks like this:

[
  {
    "type": "exact",
    "path": "db/schema.sql"
  },
  {
    "type": "exact",
    "path": "auth/tokens.ts"
  }
]

How the draft is created

The initial draft is generated from your repository's structure, then requires your explicit review and confirmation before the project is created.