Enforcement

The raw-read policy blocks a content read when the file is first-party and indexed. It is in skills/auwai/scripts/guard.py and the Hermes plugin.

Policy

guard.check_path(repo, path) returns allowed or blocked with a reason.

Allowed:

a path outside the repository;
.auwai metadata;
a skipped, generated, vendor, or unindexed file;
any file when the override is active.

Blocked:

a first-party file that is in the ledger.

guard.check_command(repo, command) parses common content commands:

cat
less
bat
sed
head
tail

rg and grep are allowed because they return matches, not full content.

Decision flow

The hook fails open when the policy cannot be loaded. The guard is a guardrail, not a sandbox; interpreter escapes remain possible.

Override

The override is active when either is true:

[guard] allow_raw_read = true in config.toml
.auwai/allow-raw-read exists

Use the override for a one-shot request or a file that the index cannot represent.

Hermes hook

The plugin registers pre_tool_call. For read_file it checks the path. For terminal it checks the command. A blocked call returns {"action": "block", "message": ...}.

The hook fails open when the guard module or the repository cannot be found. That keeps a broken integration from stopping the agent.

Current limits