# Rule sets and protections

Open, Guarded and Hardened, every ready-made protection they switch on, suggestions from your repo, and how Global and project settings combine.

You don't have to write rules to be protected. Warden ships **protections**: ready-made rules for one kind of risk each, such as reading `.env` files, force-pushing or piping a script from the internet into a shell. A **rule set** is a starting position for all of them at once.

## Pick a rule set

Open **Policies** (for all projects, or in a project) and pick a **Profile**:

| Rule set | In the app | For |
|---|---|---|
| **Open** | *runs what you don't block* | Exploring. Only the basics are enforced. |
| **Guarded** | *asks before risky steps* | Day-to-day work. Secrets, destructive commands and force-pushes are blocked; risky steps ask you. **The default.** |
| **Hardened** | *blocks risky steps* | Sensitive repositories. Risky steps are blocked rather than asked about. |

Then change any single protection to **Allow**, **Ask** or **Block**. The Policies header tells you when a scope *differs from Guarded*, and by how many protections.

## Every protection

| Group | Protection | Open | Guarded | Hardened |
|---|---|---|---|---|
| **Basic security** | Keep file access inside the project | {{deny}} | {{deny}} | {{deny}} |
| | System temp folder | {{allow}} | {{allow}} | {{ask}} |
| | Protect Warden's own guardrails | {{deny}} | {{deny}} | {{deny}} |
| **Secrets & credentials** | Environment & secret files | {{allow}} | {{deny}} | {{deny}} |
| | Private keys | {{allow}} | {{deny}} | {{deny}} |
| | Cloud credential reads | {{allow}} | {{deny}} | {{deny}} |
| | Secrets written into files | {{allow}} | {{ask}} | {{deny}} |
| **Shell & processes** | Destructive commands | {{allow}} | {{deny}} | {{deny}} |
| | Bulk deletion | {{allow}} | {{ask}} | {{deny}} |
| | Remote code piping | {{allow}} | {{deny}} | {{deny}} |
| | Unverifiable commands | {{allow}} | {{ask}} | {{deny}} |
| | Privilege escalation | {{allow}} | {{deny}} | {{deny}} |
| | Package installation | {{allow}} | {{ask}} | {{deny}} |
| | Cloud & SaaS config changes | {{ask}} | {{ask}} | {{deny}} |
| **Git & version control** | Force push | {{allow}} | {{deny}} | {{deny}} |
| | Push to protected branches | {{allow}} | {{ask}} | {{deny}} |
| | History rewriting | {{allow}} | {{ask}} | {{deny}} |
| | Identity changes | {{allow}} | {{deny}} | {{deny}} |
| | CI/CD pipeline changes | {{allow}} | {{ask}} | {{deny}} |
| **Network** | Paste-site destinations | {{allow}} | {{deny}} | {{deny}} |
| | Network fetch commands | {{allow}} | {{allow}} | {{ask}} |
| | Scripts in the Browser pane | {{ask}} | {{ask}} | {{deny}} |

The basics (staying inside the project, and protecting Warden's own settings and rule files) stay on under every rule set, so an agent can't switch its own guardrails off.

> [!NOTE] Unverifiable commands
> `eval`, `$(...)`, backticks and inline `python -c` can't be read in advance. Their inner commands are still checked, but the line as a whole is unverifiable: **Open** runs it, **Guarded** asks you, **Hardened** blocks it.

## Global and project

- **Global** applies to every project. A fresh install starts Global on **Guarded**.
- **A project** can set its own rule set and protections, but can only be **stricter** than Global. Policies says so: *Global enforces Guarded - a project can only tighten it*.

## Suggestions from your repository

On a project's Policies tab, Warden may suggest protections based on what is in the repository: secret files, key files, a git remote, CI configuration, dependency manifests, infrastructure-as-code, deploy configs and database migrations. Each suggestion shows the evidence it found, and can only tighten. This runs on your Mac with no model and sends nothing anywhere.

## Beyond protections

- **Custom rules** cover anything the protections don't. See [Writing rules](writing-rules).
- **Automated runs** can have stricter settings than your chats. See [Automated runs](automated-runs).
- **Protect data by model** adds rules that keep some data on models you trust. See [Rule recipes](rule-recipes#keep-production-data-on-approved-models).