Private Workspace Policy
Policy pack: no secrets in prompts, no external sends, no destructive ops, no production deploys, no purchases without approval.
About
Hardens a workspace for sensitive work. Blocks any prompt-side request to surface secrets, blocks external sends, blocks destructive filesystem ops, blocks production deploys, and blocks purchases or paid API calls without explicit operator approval. Enforces at runtime when used with APAI-compatible CLI agents.
Native install
For environments with file or shell access (Codex, Claude Code, Gemini CLI, Cursor, local CLI). v0.1: the apai CLI is a scaffold; real install behavior lands in Phase 1.
The apai CLI is a TypeScript scaffold at v0.1. See /honest-status for the full shipped vs stubbed list.
Prompt install
Hosted chat apps (ChatGPT, Claude, Gemini, Grok) cannot silently install software. Paste the snippet below into the chat to load the package protocol for the current conversation only.
Paste this into any LLM that does not have shell access to your machine - chatgpt.com, claude.ai, gemini.google.com, grok.com - and the model will load the Capability Passport and apply the package protocol. If you are using Claude Code, Codex, Cursor, Gemini CLI, or another tool-enabled agent, use apai install instead - it produces a durable install receipt.
Install https://apai.run/packages/private-workspace-policy for this chat. Apply private-workspace-policy to all subsequent actions: no secrets, no external sends, no destructive ops, no deploys, no purchases without explicit operator approval.
Install card source: https://apai.run/packages/private-workspace-policy/llms.txt
Capability Passport
Reads
- ·Agent tool-call metadata
Writes
- ·Policy decision log
Accesses
- ·No network access required
Spends
- ·Blocks paid API calls unless operator approves
Exposes
- ·Policy decision log is local
Approvals required
- ·Approval required to deactivate any policy rule
Rollback
Uninstall via apai rollback private-workspace-policy. Removes policy entries.
Scanner
heuristic-stub-v0 means the v0.1 scanner (13 suspicious-pattern regex checks + Unicode format-character detection) found nothing. It does NOT mean the package is certified safe. Real prompt-injection, OAuth-scope, and dependency scanning lands in Phase 5. See honest status.