Default posture
Two postures depending on whether the write targets an app, repo, or storage (with a known scope) or the computer’s raw filesystem. Out of the box, Kazzle ships with sensible defaults so the AI works immediately.
Writes to apps, repos, and storage are allowed by default because their paths are scoped to a known root. Raw computer writes are allowed except for the sensitive path patterns above.
Rule types
Terminal commands
Rules match by command prefix.git push matches git push origin main.
Default exception that requires approval: sudo. Default block: git push --force. Ordinary git push is allowed.
Browser URLs
Browser navigation is allowed by default on all URLs. Add custom rules on the browserurl field to restrict or require approval for specific sites.
File paths
Rules match by glob pattern.*.pem matches certificate files anywhere.
Default blocks on computer writes: .ssh/*, *.pem, *.key. .env writes are allowed.
File path rules can be scoped to a specific computer. A rule with “All computers” applies everywhere. A rule scoped to one computer only applies when the AI is working on that machine. Computer-specific rules take priority over global ones.
Tool approvals
Individual tools and actions can be set to allow, ask, or block. By default, app publish, app delete, and database delete ask for approval.db exec asks for DROP/TRUNCATE and allows other SQL. File deletes and git push are allowed.