Policy Advisor

[linear]

Policy Advisor is the public roadmap umbrella for OpenShell workflows that help developers and agents safely evolve sandbox policy without starting from broad access.

It covers the user-facing capability to:

• inspect effective sandbox policy and explain what is allowed or blocked
• turn structured policy denies into narrow, reviewable policy proposals
• route proposals through human or reviewer-agent approval paths
• validate proposed policy changes with deterministic prover checks where possible
• hot-reload approved policy and preserve an auditable trail of deny → propose → approve/reject → reload → retry

Current Implementation Track

• OpenShell Agent-Driven Policy Management #1062 — Agent-driven policy management MVP: deny → propose → approve/reject → hot-reload → retry.
• OpenShell Policy Prover #1059 — Policy Prover expansion and integration. The base Rust prover landed in feat(prover): add native Rust policy prover with Z3 solver #741; remaining work is broader modeling and integration into policy review workflows.
• feat(policy): add reviewer-agent path for OpenShell policy proposals #1434 — Reviewer-agent path for submitted policy proposals.

Roadmap Direction

Policy Advisor should combine deterministic checks and reviewer judgment. The policy prover should answer what can be proven about a proposed policy change; human or reviewer-agent paths should decide whether the requested capability makes sense in context.

This issue is the customer-facing roadmap card. Detailed MVP execution lives in #1062 and its linked implementation issues.