Live demo

Edit the policy and send it. The live engine is 1.1.0 since 2026-11-02 15:31Z.

Red-team a whole policy

{
 "policy": {
  "name": "devops",
  "default": "deny",
  "normalize": [],
  "rules": [
   {
    "id": "no-curl",
    "effect": "deny",
    "tool": "sh",
    "args": {
     "cmd": {
      "kind": "cmd",
      "contains": "curl"
     }
    }
   },
   {
    "id": "git-read",
    "effect": "allow",
    "tool": "sh",
    "args": {
     "cmd": {
      "kind": "cmd",
      "regex": "^git (status|log|diff)"
     }
    }
   },
   {
    "id": "no-imds",
    "effect": "deny",
    "tool": "http.get",
    "args": {
     "url": {
      "kind": "url",
      "host_in": [
       "169.254.169.254"
      ]
     }
    }
   },
   {
    "id": "web",
    "effect": "allow",
    "tool": "http.get",
    "args": {
     "url": {
      "kind": "url",
      "prefix": "https://api.github.com/"
     }
    }
   }
  ]
 },
 "must_allow": [
  {
   "tool": "sh",
   "args": {
    "cmd": "git status"
   }
  },
  {
   "tool": "http.get",
   "args": {
    "url": "https://api.github.com/repos/acme/app"
   }
  }
 ],
 "must_deny": []
}

Expected: every attack with gate, intended and patched decisions, the patch (normalize list) and a verdict

FIRME AI CORPORATION · CAIN-42 is a Byzantine trust fabric. Numbers marked "our own check" were run by us, not by an independent party. Nothing on these pages is a certification.