OpenShell policy (scaffold)
Status: Structure only — no live policy applied until build.
Intended contents
| Path | Purpose |
|---|---|
policy.yaml (or equivalent) |
Deny-by-default base for salon egress |
overlays/ |
Per-integration allowlists (Square MCP host, QBO local, channels, etc.) |
Apply via platform CLIs only: openshell policy set, nemohermes <name> policy-add / policy-remove.
See design/mcp-integrations.md and docs/POLICY.md.