Default-deny. Dangerous actions (rm -rf, sudo, curl | sh, network admin) are blocked. Warn rules produce a non-blocking warning.

Append-only JSONL: data/audit.jsonl.

Trajectory observations are redacted for common secret formats (GitHub/OAuth/ OpenAI keys, AWS access keys, private keys, password=).

subprocess (default) or docker (network disabled by default, memory limits).