# OpenShell policy

**Status:** Outline. Policy sources under `policy/openshell/`.

| Artifact | Role |
|----------|------|
| `policy/openshell/policy.yaml` | Base deny-by-default |
| `policy/openshell/overlays/` | channels, square, vagaro, quickbooks, inference |
| Generated on volume | Applied at install / connect / upgrade |

**Always deny:** social publish APIs; payment/refund/payout/bill-pay.  
**Allow when connected:** model endpoint; channel APIs; enabled SaaS hosts.

Apply via `openshell policy set` and `nemohermes … policy-add` / `policy-remove` (platform-native).

See [design/DESIGN_PLAN.md](../design/DESIGN_PLAN.md).