Policy Defaults
The Sensor adds no built-in allow rules. Omitted sections and operations have empty rule lists; an empty section is equivalent to omission. Team Server Preview expands variables without adding permissions.
Mode-only Policies
| Policy | Result |
|---|---|
{"mode":"derive"} | Learn observed behavior; default local fallback |
{"mode":"observe"} | Report every covered operation without blocking |
{"mode":"enforce"} | Treat every covered operation as an enforce-mode violation |
An empty enforce policy contains no permissions. LSM hooks deny directly; fallback hooks can terminate offending tasks when termination is enabled. Derive and review permissions first.
Omitted Rules
Only the listed operation has a permission:
{
"mode": "observe",
"path": {"open": ["all|%workspace%"]}
}All other rule lists remain empty, including if explicitly written as "ip": {}.
Default Local Selection
Local selection is --policy, then .endura/policy.json relative to the CLI’s current directory, then empty derive. It does not follow --workspace; use an absolute policy path when needed. --mode changes mode, not rules.
See central override and fallback. After startup, inspect the loaded result with endura policy describe <job-id>.