Rule tester
Test a command against Guard
Rules (click to change the mode)
- Loose rulesA scratch repo, no secrets, where you would rather not interrupt the agent.
- Ask on anything sensitiveAny real repo. Reversible work continues. Anything that deletes, publishes, or touches credentials stops.
Allow, ask, block
Allow lets the action through and the agent continues. Ask holds it until you choose. Block cuts it off. The same rule can be stricter on a production repo and looser in a sandbox, because exceptions are per project.
It is not a text filter the agent can argue with. It is a decision on the Mac, before the command continues. The agent sees the result of that decision, not an endless negotiation.
Where the built-in rules start
The 13 rules cover actions that do damage even when the prompt meant well. You do not have to write them from scratch on day one. You review them in Security and adjust.
- Recursive delete outside the project.
- sudo.
- git push --force.
- Reading secrets: .env, ~/.ssh, ~/.aws.
- Downloading a script and running it immediately, in the curl-piped-to-a-shell shape.
- Migrations and DROP statements.
- Deploys and publishing packages.
An approval you can actually read
The prompt does not only say “allow?”. It says what the command does and how risky it is. On the iPhone the buttons sit on the notification, so a one-tap decision does not require opening an SSH session or the terminal.
That fits the Inbox: the agent’s row becomes “needs you” when the question is a permission, the same as when it is a design choice. The list shortcuts still apply. More on the queue in the Inbox.
What autopilot is not allowed to do
If you turn autopilot on, doki can answer reversible things: go on, run the tests. It escalates, and therefore asks you, anything that deletes, spends, deploys, or touches credentials. It ships off. It is not a mode for leaving the agent alone over a weekend.
Even with autopilot off, every message you send waits about two seconds in case it was a yes too many. Esc pulls it back before it leaves.
Where the rules live
Guard, devices, and tasks live in ~/.doki, mode 0700. Provider keys live in the Keychain. None of that is committed with the repo or sent to doki’s server as project contents.
On a remote machine the rules are still the ones on the Mac that steers. You approve on the laptop or the phone. The command runs where the agent is. Diff review, afterward, catches secrets that still slipped into the change: review.
Frequently asked questions
Does Guard replace Claude’s or Codex’s own permissions?
It adds to them. The agent still has its own confirmation in the terminal. Guard is the Mac’s policy, the same for every agent doki steers, and you can approve it outside that terminal.
Can I set a rule to allow in only one repo?
Yes. Exceptions are per project. A sandbox and a production monorepo do not have to share the same strictness.
Can autopilot deploy?
It should not. Anything that deploys, deletes, spends, or touches credentials is escalated to you. Autopilot is for reversible work, and it ships off.
Where do I edit the rules?
In Security, inside the Mac app. The phone approves one concrete action. It is not the policy editor.
