the boundary
The blast radius, in the file
The file declares its blast radius. Permits allowlist what runs, reads, writes and calls · secrets stay masked references. Absent means the engine floor, present means default-deny.
The permit families
Two laws, the whole model: absent, the engine floor applies · present, the boundary is default-deny and the body must fit it. nika check --infer-permitswrites the tightest boundary the file can prove.
- execwhich commands may run · false kills the family
- fsread and write globs · the walk root is gated
- nethttp allowlist · the SSRF floor stays on regardless
- toolswhich nika tools the file may invoke
permits: exec: ["echo"] tools: ["nika:assert", "nika:prompt", "nika:notify"] net: { http: ["hooks.slack.com"] }The secret sources
A secret is a masked reference, never a literal: it resolves from vault, env or file at run time and stays masked in every log and every trace the run leaves behind.
- vaultthe OS keychain backend · the default posture
- envread from the environment at run time
- fileread from a path the boundary allows
secrets: webhook: source: env key: TEAM_WEBHOOK_URL egress: - to: "nika:notify" host_from_self: trueThe always-on floor
Some refusals never negotiate: link-local and metadata endpoints are refused even when net.http allows a host pattern · secret values stay masked in every log and trace a run leaves · an exec allowlist matches argv soundly, never a substring. The floor is the part of the boundary you cannot turn off.