> For the complete documentation index, see [llms.txt](https://docs.duplocloud.com/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.duplocloud.com/docs/armor/access-control/command-policy.md).

# Command Policy

Command Policies let administrators define, once, which shell commands an agent is allowed to auto-run and which are always denied — enforced platform-wide, per workspace, or per project, rather than set up manually on every ticket. It's a **Definition** (the regex rules) paired with a **Mapping** (where those rules apply).

Go to **AI Admin → Access Control → Command Policy**.

![Command Policy tab](/files/91zcG9ZD2hadOzwxSCQJ)

***

## Command Policy Definition

A Definition holds two lists of regular expressions — one per line:

* **Allow List** — commands matching any pattern here are auto-approved
* **Block List** — commands matching any pattern here are always denied, even if they also match an allow pattern

Click **+ Add** and fill in:

* **Name\*** — a label for the policy
* **Description** — optional
* **Allow List** — one regex per line
* **Block List** — one regex per line

![Add Command Policy form filled in](/files/494H86Tv6Z3u7M9P4BfZ)

![Command Policy added](/files/Qp6gNig16kEctOyQygde)

{% hint style="info" %}
The Block List always wins — if a command matches both an allow and a block pattern, it's denied. A command that matches neither list isn't auto-decided either way; it falls through to manual approval in the ticket, the same **Command Permissions** approval prompt described in [Command Permissions](/docs/armor/tickets.md#command-permissions).
{% endhint %}

***

## Command Policy Mapping

A Mapping binds a Definition to the scope it should apply to.

![Command Policy Mapping tab](/files/Z5dlDLxpgzHKnmOu9bps)

Click **+ Add** and fill in:

* **Name\*** — a label for the mapping
* **Description** — optional
* **Command Policy\*** — the Definition to apply
* **Level\*** — **System**, **Workspace**, or **Project**
* **Target Workspace(s)\*** / **Target Project(s)\*** — shown only for Workspace/Project level; select one or more

![Add Command Policy Mapping form — selecting a policy and level](/files/1xumOXgtNz0x2rkiP7WO)

![Add Command Policy Mapping form — target workspace selected](/files/7tbE9e651fPFbDmKNScl)

![Command Policy Mapping added](/files/OYyOf6C2IaFPFmkwtqVx)

Only one active mapping is allowed per level/target combination — for example, only one active System-level mapping platform-wide, and only one active mapping per workspace at the Workspace level.

{% hint style="info" %}
Command Policies are an admin-configured layer on top of the per-ticket **Command Permissions** patterns — both are combined when a command is evaluated. A command is denied if it matches a block pattern anywhere (the ticket's own patterns, or the System/Workspace/Project policy covering it); it's auto-approved only if it matches an allow pattern everywhere it's checked. Anything else is left for a person to approve on the ticket.
{% endhint %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.duplocloud.com/docs/armor/access-control/command-policy.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.