Known limitations

Warden is a developer preview, provided as is. This page lists what it doesn't do, so you can decide where to rely on it. If you find a way past a rule, please report it privately.

What is checked#

• Only agents you run inside Warden are checked. Claude Code or Codex in your own terminal isn't.
• Claude Code, API-key and local models are checked before every action. With Codex, Copilot, Devin and Kimi, anything the agent asks permission for is checked before it runs, but a tool it runs without asking is only checked as it starts: it may already have run, though a blocked result is thrown away before the agent sees it.
• Rules check each command before it runs, not what a running program does. An allowed python script.py can still read .env from inside the script.
• Commands you type in Warden's terminal aren't checked. Rules apply to the agent, not to you.
• On the Open rule set, commands Warden can't read in advance (eval, $(...), backticks, python -c) run without asking. Guarded asks; Hardened blocks.
• Command rules match flags, not every way to say the same thing. deny: "rm -rf" catches rm -fr and rm --recursive --force, but a different program that deletes files (find -delete, a script) needs its own rule.

Rules#

• A touches: rule takes one value. For several, write one rule each.
• In a sandboxed run, anything named in a deny or ask rule is unreachable, including values under unless:. Deny all web fetches unless github.com also blocks github.com inside the sandbox.
• Rule files live on your Mac, not in the repository. Share them with Export bundle and Import bundle, or company-wide with Warden Team.

Software Factory#

• The pipeline and its items live on one Mac. They don't sync to teammates yet, and nothing moves while Warden is closed.
• A local merge doesn't push. Staging and Production advance only once the change reaches the remote branch, tag or deployment you defined.
• The Factory never deploys and never merges a pull request by itself, and doesn't show CI logs.
• Express's policy review passes when no assurance checks are configured. Set up checks before you let Express merge unattended.
• Up to two sandboxed builds run at once, and triage, drafting and reviews run one at a time. An unattended merge of more than 300 files is held.
• Builds start from origin only, and a build's starting point can't change once its worktree exists.

Assurance and review#

• L2 plants up to five bugs per change: a useful signal, not a full mutation-testing run.
• L4 needs Dafny or Lean installed on your Mac.
• Risk levels in the review walkthrough come from path and keyword rules, not from understanding the code.
• Assurance gates, automations, the review policy and model settings are stored on your Mac. Workflows, agents, checks, plans and specs are stored in the repository.

Other#

• Restore points skip git-ignored files, so they won't bring back a deleted .env.
• Automation schedules fire only while Warden is open.
• Apple Silicon Macs only (M1 or later). No Windows, Linux or Intel builds yet.
• It's a developer preview, provided as is, with no warranty.