OpenShell policies #4474

NVIDIA’s OpenShell is an open-source runtime for AI agents and a CNCF Sandbox project. It isolates agent workloads and enforces access policies. Its policy framework supports checking that the permissions granted by a policy stay within a defined ceiling, enabling controlled delegation and refinement toward least privilege.

This issue defines the following tenets for OpenShell’s policy framework and tracks the work required to implement them.

1. Decidable policy analysis. For every supported policy pair A and B, checking whether the permissions granted by A are a subset of those granted by B—and vice versa—must be decidable. Policy language features and extensions must preserve this property.
2. Reuse existing open-source work. Prefer established open-source policy languages, decision procedures, and verification tools where they meet OpenShell’s requirements. Build on existing expertise and contribute improvements upstream where practical.
3. Soundness before additional expressivity. Policy analysis and enforcement must faithfully reflect the defined policy semantics. Restrict supported features where necessary to preserve soundness and decidability. Unsupported constructs or inconclusive checks must never be treated as proof that a policy stays within its ceiling.
4. Performance as a core requirement. Target sub-millisecond authorization evaluation under defined workloads and deployment conditions. Benchmark policy inclusion checks against leading applicable decision procedures, with explicit latency budgets for representative policy sizes and complexity.
5. Modularity and independent use. Where practical, policy components must expose clear interfaces and be runnable independently of the full OpenShell runtime. This supports isolated development and testing, reuse in other systems, and flexibility across deployment environments and use cases.

This is the parent issue for all policy-related work. Child issues should identify the principle they address and define concrete acceptance criteria.