# OpenShell policy (scaffold)

**Status:** Structure only — no live policy applied until **build**.

## Intended contents

| Path | Purpose |
|------|---------|
| `policy.yaml` (or equivalent) | Deny-by-default base for salon egress |
| `overlays/` | Per-integration allowlists (Square MCP host, QBO local, channels, etc.) |

Apply via platform CLIs only: `openshell policy set`, `nemohermes <name> policy-add` / `policy-remove`.

See [design/mcp-integrations.md](../../design/mcp-integrations.md) and [docs/POLICY.md](../../docs/POLICY.md).