Policies — ARC Control

FINANCE-004 v1 Autonomous refund authority enabled

Bounds how much a finance agent may refund without a human. Refunds are irreversible, so the ceiling is a hard stop rather than a warning.

tools:stripe.refund domain=financeSOX-302

Disable…

1 under-500

when amount < 500

within autonomous refund authority

Routine customer-service refunds.

ALLOW
2 needs-approval

when amount ≤ 2500

above autonomous refund authority, below the hard ceiling

Material refunds need a finance manager.

needs 1 of role:finance-manager · SoD · expires after 60 min

REQUIRE_APPROVAL
3 over-ceiling

when always

exceeds autonomous refund authority

No agent refunds this much, approved or otherwise.

DENY
Fallback
if no rule matched: no refund rule matched
DENY

Raw policy (JSON)

{
  "id": "FINANCE-004",
  "version": 1,
  "name": "Autonomous refund authority",
  "description": "Bounds how much a finance agent may refund without a human. Refunds are irreversible, so the ceiling is a hard stop rather than a warning.",
  "enabled": true,
  "match": {
    "tools": [
      "stripe.refund"
    ]
  },
  "rules": [
    {
      "id": "under-500",
      "description": "Routine customer-service refunds.",
      "when": {
        "lt": [
          "$.action.parameters.amount",
          500
        ]
      },
      "effect": "ALLOW",
      "reason": "within autonomous refund authority"
    },
    {
      "id": "needs-approval",
      "description": "Material refunds need a finance manager.",
      "when": {
        "lte": [
          "$.action.parameters.amount",
          2500
        ]
      },
      "effect": "REQUIRE_APPROVAL",
      "reason": "above autonomous refund authority, below the hard ceiling",
      "approval": {
        "approvers": [
          "role:finance-manager"
        ],
        "minApprovals": 1,
        "expiresInSeconds": 3600,
        "requireSeparationOfDuties": true
      }
    },
    {
      "id": "over-ceiling",
      "description": "No agent refunds this much, approved or otherwise.",
      "when": {
        "always": true
      },
      "effect": "DENY",
      "reason": "exceeds autonomous refund authority"
    }
  ],
  "fallback": {
    "effect": "DENY",
    "reason": "no refund rule matched"
  },
  "labels": {
    "domain": "finance",
    "control": "SOX-302"
  },
  "createdAt": "2026-10-26T09:18:23.716Z",
  "updatedAt": "2026-10-26T09:18:23.716Z"
}

GITHUB-002 v1 Repository writes enabled

Engineering agents may open issues and pull requests freely, but never touch the default branch.

tools:github.* domain=engineering

Disable…

1 no-default-branch

when branch is one of ["main", "master", "release"]

agents may not write to a protected branch

DENY
2 issues-and-prs

when tool.name is one of ["github.create_issue", "github.create_pull_request"]

opening issues and pull requests is reviewable by design

ALLOW
Fallback
if no rule matched: unclassified repository write
REQUIRE_APPROVAL

Raw policy (JSON)

{
  "id": "GITHUB-002",
  "version": 1,
  "name": "Repository writes",
  "description": "Engineering agents may open issues and pull requests freely, but never touch the default branch.",
  "enabled": true,
  "match": {
    "tools": [
      "github.*"
    ]
  },
  "rules": [
    {
      "id": "no-default-branch",
      "when": {
        "in": [
          "$.action.parameters.branch",
          [
            "main",
            "master",
            "release"
          ]
        ]
      },
      "effect": "DENY",
      "reason": "agents may not write to a protected branch"
    },
    {
      "id": "issues-and-prs",
      "when": {
        "in": [
          "$.tool.name",
          [
            "github.create_issue",
            "github.create_pull_request"
          ]
        ]
      },
      "effect": "ALLOW",
      "reason": "opening issues and pull requests is reviewable by design"
    }
  ],
  "fallback": {
    "effect": "REQUIRE_APPROVAL",
    "reason": "unclassified repository write"
  },
  "labels": {
    "domain": "engineering"
  },
  "createdAt": "2026-10-26T09:18:23.717Z",
  "updatedAt": "2026-10-26T09:18:23.717Z"
}