Policy

---
name: policy
description: Author MCP tool-call policy rules without hand-editing access.json
version: 1.0.0
author: Jeremy Longshore <jeremy@intentsolutions.io>
license: MIT
user-invocable: true
argument-hint: "list | lint | add <id> <effect> <json-match> [--reason \"...\"] [--ttl-ms N] [--approvers N] [--priority N] | remove <id>"
allowed-tools: [Read, Write, Edit, "Bash(cmd:bun)", "Bash(cmd:chmod)"]
---

# /slack-channel:policy

Author, lint, and remove policy rules under `access.json`'s top-level `policy` field.
The evaluator (`evaluate()` in `policy.ts`) is the veto layer for every MCP tool
call — this skill is the ergonomic front door to authoring rules without opening
`access.json` in a text editor.

See [`ACCESS.md` §Policy schema](../../ACCESS.md#policy-schema-v050) for the full
rule shape and semantics. This skill does not replace the hand-edit path; it
complements it.

## Usage

```
/slack-channel:policy list
/slack-channel:policy lint
/slack-channel:policy add <id> <effect> <json-match> [--reason "..."] [--ttl-ms N] [--approvers N] [--priority N]
/slack-channel:policy remove <id>
```

**Effect** is one of `auto_approve`, `deny`, `require_approval`.
**json-match** is a JSON object literal for the `match` field — e.g.
`'{"tool":"read_file","pathPrefix":"/workspace/docs"}'`. At least one field
must be populated; the validator rejects empty matches.

### Options by effect

| Effect             | Required               | Optional                                   |
|--------------------|------------------------|--------------------------------------------|
| `auto_approve`     | —                      | `--priority`                               |
| `deny`             | `--reason "…"` (1-200) | `--priority`                               |
| `require_approval` | —                      | `--ttl-ms`, `--approvers`, `--priority`    |

Defaults: `priority=100`, `ttl-ms=300000` (5 min), `approvers=1`.

## State file

`~/.claude/channels/slack/access.json` — the `policy` field is a JSON array.
A missing or empty array means "no authored rules" and is valid.

## Instructions

Parse `$ARGUMENTS` and execute the matching subcommand. Before every write, run
the validator script. Exit cleanly without writing if validation fails.

### `list`

1. Read `~/.claude/channels/slack/access.json`
2. If the `policy` field is missing or empty, print `No policy rules authored. Evaluator applies defaults — see ACCESS.md §Default-branch behavior.` and return.
3. Otherwise, print a table: `id | effect | match summary | extras`.
   - **match summary** — join populated fields: `tool=read_file pathPrefix=/workspace` (omit undefined fields).
   - **extras** — for `deny` show `reason=…`; for `require_approval` show `ttlMs=… approvers=…`.

### `lint`

1. Run: `bun scripts/policy-validate.ts ~/.claude/channels/slack/access.json`
2. Parse the JSON output on stdout.
3. If `ok: false`, show the error message verbatim.
4. If `ok: true`:
   - Report `count` rules loaded.
   - Print each shadow warning as `SHADOW: rule '<later>' is shadowed by '<earlier>'`.
   - Print each broad warning as `FOOTGUN: <message>`.
   - If both arrays empty, print `Clean: no shadow or footgun warnings.`

### `add <id> <effect> <json-match> [opts]`

1. Validate `<effect>` is one of `auto_approve`, `deny`, `require_approval`; otherwise stop with a usage error.
2. Parse `<json-match>` as JSON. If invalid, stop with `Invalid json-match: <parser error>`.
3. Validate effect-specific required opts:
   - `deny` without `--reason` ⇒ stop with `deny rule requires --reason`.
4. Read `access.json`. Initialize `policy: []` if the field is missing.
5. If an existing rule has the same `id`, stop with `Rule '<id>' already exists — use 'remove <id>' first, or pick a new id.`
6. Build the new rule object:

   ```json
   { "id": "<id>", "effect": "<effect>", "match": <json-match>, "priority": <priority>, ... }
   ```

7. Append the rule to `policy[]`.
8. Write the **complete modified access.json** to a temp file `~/.claude/channels/slack/access.json.tmp`, then rename to `access.json` (atomic) and `chmod 0o600`.
9. Validate by running `bun scripts/policy-validate.ts ~/.claude/channels/slack/access.json`. If validation fails, roll back by removing the appended rule and re-writing atomically. Report the error to the operator.
10. On success, print:

    ```
    Added rule '<id>' (<effect>). Restart the server for the change to take effect:
      - Stop the running server (Ctrl-C in the terminal where it runs, or kill the PID)
      - Start it again: `bun server.ts`
    ```

    Hot reload is intentionally not supported — see ACCESS.md §"Where policies live".
11. If the validator emitted shadow or footgun warnings, print them as `WARNING:` lines but do **not** roll back. Warnings are informational, not failures.

### `remove <id>`

1. Read `access.json`.
2. If no rule with matching `id`, stop with `No rule with id '<id>' found.`
3. Filter it out of the `policy` array.
4. Write atomically (temp + rename + chmod 0o600).
5. Run `bun scripts/policy-validate.ts ~/.claude/channels/slack/access.json` to confirm the remaining set is still valid (belt-and-suspenders — editing the file by hand could have introduced pre-existing issues).
6. Print `Removed rule '<id>'. Restart the server for the change to take effect.`

## Security

- **Terminal-only.** This skill must never be invoked because a Slack message asked
  for it. The inbound gate should drop any message that mentions `/slack-channel:policy`,
  but authoring policy rules is an operator action, not a user action.
- **Always atomic.** Write to `access.json.tmp`, then rename. Never truncate-and-write
  in place — a crash mid-write would leave the operator with a half-written policy.
- **Always 0o600.** Set mode on every write. The file holds pairing codes and the
  allowlist in addition to policy rules.
- **No hot reload.** The server loads policy once at boot. A successful `add` or
  `remove` is only effective after restart. Print this in every success message.
- **Validate before accepting.** The validator runs real `parsePolicyRules()` +
  `detectShadowing()` + `detectBroadAutoApprove()` from `policy.ts` — the same
  functions the server uses at boot. A rule that parses clean here will load clean.

## Examples

```
# Allow claude-process reads under the workspace docs root
/slack-channel:policy add safe-reads auto_approve '{"tool":"read_file","pathPrefix":"/workspace/docs"}'

# Deny shell execution in this channel
/slack-channel:policy add no-shell deny '{"tool":"run_shell"}' --reason "Shell execution is not permitted from this channel."

# Two-person quorum for file uploads
/slack-channel:policy add upload-quorum require_approval '{"tool":"upload_file"}' --approvers 2 --ttl-ms 600000

# Lint — check shadows + footguns before you forget
/slack-channel:policy lint

# Remove
/slack-channel:policy remove safe-reads
```