aiignore

A testable policy proposal for controlling how agentic harnesses access files, environment variables, networks, and sensitive strings.

Experimental draft 0.1. This is not an industry standard, has not been independently audited, and is not a security boundary by itself. Assurance depends on the enforcement paths a harness actually mediates.

Start with one file

Structured policies use .aiignore.yaml. The exact filename .aiignore remains reserved for tools that already interpret it as gitignore-style path syntax.

aiignore: "0.1"
defaults:
  network: deny
rules:
  files:
    - id: secrets
      effect: deny
      paths: ["**/.env*", "secrets/**"]

Normative artifacts