deny-all-star · Policies

Versions

Every registered version of deny-all-star, most recently registered first; an archived version stays listed
Version	Content hash	Registered	Compare	Governs	Change
1 text shown below	372386e5640cac62ddae3f123707fc2e39426f5577c7b052097a9358cc575c39	2026-09-05T21:54:13Z	only version	no agents	Edit as new version

Policy text

Version 1, registered 2026-09-05T21:54:13Z.

Content hash: 372386e5640cac62ddae3f123707fc2e39426f5577c7b052097a9358cc575c39

apiVersion: krynix.dev/v1
kind: Policy
metadata: { name: deny-all-star, version: "1", description: "deny every tool_call" }
spec:
  scope: { agents: ["*"], event_types: [tool_call] }
  rules:
    - id: deny-everything
      description: unconditional deny
      match: { event_type: tool_call, payload: [] }
      action: deny
      message: "denied unconditionally"
      severity: critical
  defaults: { unmatched_action: deny }

What changed

Only one version of this policy is registered, so there is nothing to compare it against.

Change audit

Every recorded change to deny-all-star, most recent first
When	Action	Version	By	Content hash
2026-10-26T02:27:38Z	baseline_remove	1	maya.lindqvist@meridian.dev	372386e5640cac62ddae3f123707fc2e39426f5577c7b052097a9358cc575c39
2026-10-26T02:27:28Z	baseline_add	1	maya.lindqvist@meridian.dev	372386e5640cac62ddae3f123707fc2e39426f5577c7b052097a9358cc575c39
2026-09-05T21:54:13Z	create	1	tomas.rezek@meridian.dev	372386e5640cac62ddae3f123707fc2e39426f5577c7b052097a9358cc575c39

An archive row records that a version stopped deciding; its text is still readable by name and version. A delete row predates archiving: that version’s text did not survive, so the row is the only remaining evidence it existed.