Capability policy

{
  "schemaVersion": 1,
  "id": "default",
  "description": "Default AX Harness capability vocabulary. Reads are broad, writes are narrow and reviewed, and the five high-impact capabilities are denied to every role.",
  "capabilities": [
    {
      "id": "read_code",
      "title": "Read repository code",
      "description": "Read source, tests, and configuration in the working repository.",
      "tool": "codebase",
      "risk": "low",
      "humanApproval": false,
      "deniedToAllAgents": false
    },
    {
      "id": "read_docs",
      "title": "Read documentation and context",
      "description": "Read the Markdown context a project declares, plus repository documentation.",
      "tool": "docs",
      "risk": "low",
      "humanApproval": false,
      "deniedToAllAgents": false
    },
    {
      "id": "github_read",
      "title": "Read GitHub metadata",
      "description": "Read GitHub repository metadata, the default branch, and pull requests. Executed by ax pr and ax doctor through the GitHub adapter.",
      "tool": "github",
      "risk": "low",
      "humanApproval": false,
      "deniedToAllAgents": false
    },
    {
      "id": "database_metadata",
      "title": "Read database metadata",
      "description": "Inspect schema, tables, columns, indexes, and constraints. Never row data, and never writes.",
      "tool": "database",
      "risk": "medium",
      "humanApproval": false,
      "deniedToAllAgents": false
    },
    {
      "id": "run_tests",
      "title": "Run declared quality commands",
      "description": "Run the build, lint, typecheck, or test commands the project declared. No other command is implied.",
      "tool": "codebase",
      "risk": "medium",
      "humanApproval": false,
      "deniedToAllAgents": false
    },
    {
      "id": "edit_worktree",
      "title": "Edit an isolated worktree",
      "description": "Modify files on a working branch. Never on the default branch, and never in someone else's checkout.",
      "tool": "codebase",
      "risk": "medium",
      "humanApproval": false,
      "deniedToAllAgents": false
    },
    {
      "id": "create_branch",
      "title": "Create a working branch",
      "description": "Create and switch onto a new local feature branch. Never the default branch or a reserved name. Enforced by ax git; pushing is push_working_branch.",
      "tool": "codebase",
      "risk": "medium",
      "humanApproval": false,
      "deniedToAllAgents": false
    },
    {
      "id": "commit_worktree",
      "title": "Commit selected files",
      "description": "Stage an explicit list of files on a working branch and commit them. Never git add of a whole tree, never a secret path. Enforced by ax git.",
      "tool": "codebase",
      "risk": "medium",
      "humanApproval": false,
      "deniedToAllAgents": false
    },
    {
      "id": "push_working_branch",
      "title": "Push a working branch",
      "description": "Push a feature branch to a declared remote without force. Never the default branch, never a tag or another ref. Enforced by ax git.",
      "tool": "codebase",
      "risk": "medium",
      "humanApproval": false,
      "deniedToAllAgents": false
    },
    {
      "id": "read_ci",
      "title": "Read CI status",
      "description": "Read check runs and commit statuses for one exact commit. Pending, absent, and unreadable are never reported as passed. Executed by ax ci through the GitHub adapter.",
      "tool": "github",
      "risk": "low",
      "humanApproval": false,
      "deniedToAllAgents": false
    },
    {
      "id": "comment_issue_or_pr",
      "title": "Comment on an issue or pull request",
      "description": "Add review comments. Comments are visible to others, so they are a write, not a read.",
      "tool": "github",
      "risk": "medium",
      "humanApproval": false,
      "deniedToAllAgents": false
    },
    {
      "id": "create_pull_request",
      "title": "Open a pull request",
      "description": "Propose changes for review. High impact because it asks other people to act. ax pr requires an approval bound to repository, head, base, and commit.",
      "tool": "github",
      "risk": "high",
      "humanApproval": true,
      "deniedToAllAgents": false
    },
    {
      "id": "database_write",
      "title": "Write to a database",
      "description": "Insert, update, delete, or migrate data. Denied in v1; database access is metadata-only.",
      "tool": "database",
      "risk": "high",
      "humanApproval": false,
      "deniedToAllAgents": true
    },
    {
      "id": "direct_main_push",
      "title": "Push directly to the default branch",
      "description": "Denied in v1. Changes reach the default branch through a reviewed pull request. ax git refuses a branch that is the default or a reserved name.",
      "tool": "github",
      "risk": "high",
      "humanApproval": false,
      "deniedToAllAgents": true
    },
    {
      "id": "force_push",
      "title": "Force push",
      "description": "Denied in v1, because it can destroy history that other people depend on. ax git never constructs a forced or lease-forced push.",
      "tool": "github",
      "risk": "high",
      "humanApproval": false,
      "deniedToAllAgents": true
    },
    {
      "id": "preview_deploy",
      "title": "Deploy to a preview environment",
      "description": "Start a declared preview or development deployment of one exact, pushed, verified commit through a provider adapter. Enforced by ax deploy.",
      "tool": "none",
      "risk": "medium",
      "humanApproval": false,
      "deniedToAllAgents": false
    },
    {
      "id": "staging_deploy",
      "title": "Deploy to staging",
      "description": "Start a declared staging deployment of one exact, pushed, verified commit. Requires an approval bound to target and commit. Enforced by ax deploy.",
      "tool": "none",
      "risk": "high",
      "humanApproval": true,
      "deniedToAllAgents": false
    },
    {
      "id": "production_deploy",
      "title": "Deploy to production",
      "description": "Denied in v1. Deployment to production stays a human action outside the harness, and ax deploy refuses every production target whatever the flags.",
      "tool": "none",
      "risk": "high",
      "humanApproval": false,
      "deniedToAllAgents": true
    },
    {
      "id": "secrets_access",
      "title": "Read secrets",
      "description": "Denied in v1. Credentials never enter configuration, context, agent output, or diagnostics.",
      "tool": "none",
      "risk": "high",
      "humanApproval": false,
      "deniedToAllAgents": true
    }
  ]
}