keycard-query-policy

keycard-query-policy

You are helping the user understand their active Cedar policy. This skill is read-only — to modify the policy, direct the user to /keycard-upsert-policy.

See .agents/reference/cedar-policy.md for Cedar syntax reference. Policy reads must always use keycard agent policy — never the Read tool on the file directly.

Step 1 — Accept question

The user's input is: $ARGUMENTS

If $ARGUMENTS is empty, ask: "What would you like to know about the policy? (e.g. 'May I use Bash?', 'What tools are allowed?', 'Why was X blocked?')"

Wait for the response, then continue to Step 2.

Step 2 — Read the policy

Run:

keycard agent policy

If the command fails (no policy file or CLI error), display the returned message and stop.

Step 3 — Answer

Handle the question or diagnostic request using the policy from Step 2:

Q&A intents

• "May I use X?" — state allow or deny, citing the specific Cedar clause. If a forbid matches, note it takes precedence over any permit.
• "What can I do?" / "What tools are allowed?" — list all tools covered by permit clauses. Note any with @itl (require approval). Note any forbid overrides.
• Active-policy questions — answer questions about the contents of the loaded policy (e.g. "do I have any @itl rules?") using the policy text from Step 2. For abstract Cedar concepts not tied to the active policy, say: "That's a general Cedar question — see .agents/reference/cedar-policy.md for syntax details. To change your policy, run /keycard-upsert-policy."

Block-diagnosis intents

When the user reports a tool was blocked ("a tool was just blocked", "Why was X blocked?"):

1. Identify the tool name from $ARGUMENTS or ask: "Which tool was blocked? (e.g. Bash, Read, MCP(server.function))"
2. Search the policy for clauses matching the tool name (case-insensitive, e.g. Tool::"bash" matches Bash). If a matching clause has when/unless conditions, note that it may only apply conditionally — quote the conditions alongside the clause.
3. Output exactly three parts for whichever case applies:

Case A — One or more matching forbid clauses found:

1. Diagnosis: "A forbid clause is blocking this tool — adding a permit will have no effect while it remains."
2. Blocking clause(s): Quote all matching forbid clauses exactly as they appear in the policy.
3. Suggested fix: "Remove or narrow the forbid clause by running /keycard-upsert-policy <change request>."

Case B — No matching permit found (and no active forbid):

1. Diagnosis: "No permit clause was found for this tool."
2. Blocking clause: "no matching permit found"
3. Suggested fix: "Add a permit clause by running /keycard-upsert-policy allow the <tool name> tool."

Case C — A permit exists but no forbid is present:

1. Diagnosis: "A permit clause exists, but it may carry unsatisfied when/unless conditions, or the tool requires in-the-loop (@itl) approval not given at call time."
2. Matching clause(s): Quote all matching permit clause(s) exactly, including any when/unless conditions.
3. Suggested fix: For @itl: "Approve the tool call when prompted." For conditional permits: "Check whether the runtime context matched the when conditions; run /keycard-upsert-policy to loosen or remove the condition."

Keep answers concise. Quote relevant Cedar clause(s) to justify the answer. Do not propose or write any policy changes.

Examples

"May I use X?" query:

Input: May I use the Bash tool?

Output:

Allowed. The following clause permits it:

permit (principal, action == Action::"Agent::ToolUse", resource == Tool::"bash");

No active forbid overrides this.

---

"What tools are allowed?" query:

Input: What tools are allowed?

Output:

Permitted tools:

• bash — unrestricted
• read — requires in-the-loop approval (@itl)

No forbid clauses are active.

---

Block-diagnosis — Case A (forbid found):

Input: Why was Read blocked?

Output:

Diagnosis: A forbid clause is blocking this tool — adding a permit will have no effect while it remains.

Blocking clause:

forbid (principal, action == Action::"Agent::ToolUse", resource == Tool::"read");

Suggested fix: Remove or narrow the forbid clause by running /keycard-upsert-policy remove the forbid on the Read tool.