feat(policy): add deny rules to network policy schema#822
Merged
johntmyers merged 2 commits intomainfrom Apr 15, 2026
Merged
Conversation
Closes #565 Add L7 deny rules that block specific requests even when allowed by access presets or explicit allow rules. Deny rules mirror the full capability set of allow rules (method, path, query params, SQL command) and take precedence -- if a request matches any deny rule, it is blocked regardless of allow rules. This enables the "allow everything except these specific operations" pattern without enumerating every allowed endpoint. For example, granting read-write access to GitHub while blocking PR approvals, branch protection changes, and ruleset modifications.
2 tasks
|
🌿 Preview your docs: https://nvidia-preview-pr-822.docs.buildwithfern.com/openshell |
…dation Addresses PR review findings P1 and P3: P1: Deny-side query matching now uses fail-closed semantics. If ANY value for a query key matches the deny matcher, the deny fires. The previous implementation reused allow-side "all values must match" logic which allowed ?force=true&force=false to bypass a deny on force=true. P3: Deny-side query validation now mirrors the full allow-side checks: empty any lists, non-string matcher values, glob+any mutual exclusion, glob type checks, and glob syntax warnings are all validated.
drew
approved these changes
Apr 15, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Add L7 deny rules to the network policy schema, enabling the "allow everything except these specific operations" pattern. Deny rules mirror the full capability set of allow rules (method, path, query params, SQL command) and take precedence -- if a request matches any deny rule, it is blocked regardless of allow rules.
Related Issue
Closes #565
Changes
proto/sandbox.proto: AddL7DenyRulemessage (mirrorsL7Allow) anddeny_rulesrepeated field onNetworkEndpointcrates/openshell-policy/src/lib.rs: AddL7DenyRuleDefserde struct with full parity (method, path, command, query), adddeny_rulesfield toNetworkEndpointDef, wire up bidirectionalto_proto/from_protoconversionscrates/openshell-sandbox/src/opa.rs: Passdeny_rules(including query matchers) through to Rego inproto_to_opa_data_jsoncrates/openshell-sandbox/src/l7/mod.rs: Validatedeny_rulesinvalidate_l7_policies-- require protocol, validate method/path/command/query, check glob syntax, reject empty listscrates/openshell-sandbox/data/sandbox-policy.rego: Adddeny_requestrule that reuses existing matchers (method_matches,path_matches,query_params_match,command_matches). Modifyallow_requestto checknot deny_request. Add deny-specificrequest_deny_reason. Separatedeny_query_params_matchfor deny-side query evaluationdocs/reference/policy-schema.mdx: Document deny rules -- add to endpoint object table, add Deny Rule Object section with field table and example.agents/skills/generate-sandbox-policy/SKILL.md: Add deny rules section with guidance on when to use deny rules vs explicit allow rulesDeviations from Plan
None -- implemented as planned.
Testing
cargo fmt --checkpassescargo clippypasses (no new warnings)Tests added:
query.any, reject unknown fields in deny ruleChecklist