Proposed specificationSource-located exemplarH2

Policy floor

Preserve minimum restrictions across customization.

JOIN POINTpolicy_compositionRECORD STATUSCandidate · v0.1.0

UML class view

The proposed contract drawn as participant roles, received calls, and numbered dependencies.

Object interactions

The same roles and calls as a class collaboration and a numbered message sequence.

Object interaction diagram for Policy floor, showing role collaboration and a numbered message sequence — FIG. P22 / OBJECT INTERACTIONS
Open full SVG Download PDF

Pointcut

Where the mechanism applies. All four dimensions belong to the proposed match, not just its vocabulary.

Context: Multiple general, project, user, or session policies are merged.
Trigger: A proposed action is authorized under composite policy.
Structure: Minimum floor rules, merge operator, and privileged override path.
Effect: Composition cannot weaken protected restrictions without explicit authority.

Protected contract

The obligation that clients, operators, and auditors should be able to rely on.

Requires: Rule identity and priority or set semantics are defined.
Ensures: The merged result is at least as restrictive as every floor obligation.
Invariant: Local customization cannot silently erase a protected deny rule.
Violation: Conflicts produce deny, escalation, or explicit configured precedence.

Negative control

A single configurable allowlist has no composition floor.

Variation & lifecycle

The hot spot is admitted only where the protected semantics survive.

Permitted variation

Intersection, ordered layers, scoped profiles, and administrative overrides.

Test obligation

Test widening, conflicting rules, missing policy, and privileged override.

Evolution question

Did policy composition become monotonic with explicit exceptions?

Prompt + code design

An illustrative prompt and a small design sketch for the proposed contract. Names and APIs are invented; this is not a repository excerpt.

PROMPT SKETCH

Compose policy layers by intersection, not by last-writer-wins. The merged decision must be at least as restrictive as every floor obligation, and the effective rule must be attributable.

CODE DESIGN / PYTHON

def merge(layers):
    decisions = [layer.evaluate(request) for layer in layers]
    denied = [decision for decision in decisions if decision.denied]
    if denied:
        return Decision.deny(denied, source=denied[0].source)
    return Decision.allow(
        max(decisions, key=lambda decision: decision.restrictiveness)
    )

Illustrative design sketch. A permissive override may add capability, but it must not erase a floor. This example is a teaching aid, not implementation evidence or a conformance claim.

Detection & matching

The frozen rule that retrieves this record, the canonical source exemplar, and the control that should stay unmatched.

Join point: policy_composition
Source locator: Barbaste et al., §10.7, p. 38 (Hermes, “A Policy Floor That Survives YOLO”); source label
Lexical cue: (?i)\b(?:policy[_-]?floor|minimum[_-]?policy|deny[_-]?rules?|policy[_-]?composition)\bFrozen expression, v0.1.0. A match is a retrieval cue, not a confirmed implementation.
Aliases: policyfloor, minimumpolicy, denyrules, policycomposition
Canonical exemplar: anomalyco/opencodepackages/core/src/permission.ts:20Support: packages/core/test/permission.test.ts:1
Negative control: A single configurable allowlist has no composition floor.

Scope-anchored review. pohe-agent analyze <repo> --pattern P22 anchors the cue to its enclosing declaration and checks a separate operational signature for all four pointcut dimensions. Missing roles and negative-control risks remain visible; a structural match is not E2/E3. Calibration report ↗

Repository files

Up to five public files retrieved by the frozen cue and pinned to the audited commit. A match is a place to inspect, not a confirmed implementation.

01anomalyco/opencodepackages/core/src/permission.ts:20CANONICAL SOURCE 02openai/openai-agents-pythonsrc/agents/sandbox/sandboxes/unix_local.py:982RETRIEVAL CUE 03QwenLM/qwen-codepackages/core/src/config/config.ts:8672RETRIEVAL CUE 04affaan-m/ECCdocs/ECC-PRO-SECURITY-ROADMAP.md:250RETRIEVAL CUE 05deepseek-ai/deepseek-harnessdocs/upgrade-guide/v0.2.1-rc.2/headless-policy-composition/guide.i18n.yaml:4RETRIEVAL CUE

Evidence & provenance

Each layer answers a different question. Do not substitute retrieval for review.

Source-located exemplar

A concrete source anchor is available for this proposed record. It is one exemplar, not evidence that all repositories—or every contract field—conform.

Review boundary: this candidate and its specification come from an AI-assisted study. Independent human validation remains open.

ANY-EVIDENCE FAMILY COVERAGE8/36

22.2% of repository families in the frozen panel have at least one current cue, historical cue, or canonical source layer. This is not confirmed prevalence.

Current lexical-cue repositories: 7 / 41

Canonical source anchoranomalyco/opencode 885df74024b6packages/core/src/permission.ts:20

Supporting surfacepackages/core/test/permission.test.ts:1

Missing agent permissions resolve to deny-all, then merge with session policy.

Exploratory retrieval cue Regex / v0.1.0

(?i)\b(?:policy[_-]?floor|minimum[_-]?policy|deny[_-]?rules?|policy[_-]?composition)\b

This expression is a discovery instrument only. A match is a retrieval cue—not a confirmed implementation, pointcut match, or contract proof.