Policy

Written policy

phoenix policy rules lists machine-checkable setup rules. phoenix policy check, phoenix policy check FILE, and phoenix policy check --json evaluate the active or named policy and return a nonzero status on failure.

Policy can assert configuration expectations such as privacy mode, required approvals, public network exposure, audit settings, allowed providers, or disabled tools. A missing or malformed policy is reported rather than guessed.

Policy checks configuration. Runtime enforcement still belongs to the workspace jail, command gate, approval queue, egress filter, allowlists, gateway authentication, and tool controls described in Security and Tools.