ABOM Policy Builder

Build a policy

Fill in what you want to enforce. The JSON updates live and stays schema-valid.

name — identifier shown in findings

description — optional, documentation only

allowed_models — one per line; empty = unconstrained

allowed_egress_endpoints — one per line; empty list = deny all omit field (leave egress endpoints unconstrained)

no_egress_classifications — must never leave the boundary

egress_allowed — allow outbound egress at runtime (default: denied)

consequential_actions — one rule per line

require_approval_when

max_iterations_cap — blank = none

approval_required_for_consequential

policy.json

{}

loading schema…

Heads up: this builds an unsigned policy. It is not a signed ABOM manifest — manifests are produced and ed25519-signed by the CLI (abom scan / abom sign). Use this policy with abom verify --policy and the abom gate.

Validate a policy

Paste an ABOM enforcement policy (or load a file). It's checked against abom-policy-0.1.schema.json — the same schema the CLI uses.

Load file…

loading schema…

The validator checks structure against the schema (field names, types, enums, no unknown keys). It does not evaluate runtime behavior — for that, run abom verify abom.json --policy your.json. See the field reference.