SecurityPolicyCard
Policy status card showing compliance metrics, violation counts, and flow stats with sparklines. Green border for compliant (cool), red for active violations (hot).
Credential Redaction
Intercepts file reads and replaces credential patterns with REDACTED_BY_POLICY placeholders
Flows Governed
Compliance
Violations
Source | Dataflow | Destination | Violation | Time |
|---|---|---|---|---|
cursor-agent-7f3a | Credential | S local filesystem | Read RAILWAY_TOKEN from config | Apr 25, 2:32 PM |
cursor-agent-7f3a | Infrastructure | S backboard.railway.app | Unapproved destination | Apr 25, 2:32 PM |
cursor-agent-7f3a | Destructive | S backboard.railway.app/graphql | volumeDelete mutation | Apr 25, 2:32 PM |
Credential Redaction
Intercepts file reads and replaces credential patterns (API keys, bearer tokens, PEM headers) with REDACTED_BY_POLICY. The agent never sees real tokens.
Flows Governed
Compliance
Violations
Trust-Based Progressive Enforcement
Behavioral trip wire. Scores agents on the Lethal Trifecta — external communication, sensitive data access, untrusted content. Auto-escalates enforcement.
Flows Governed
Compliance
Violations
Destination Allowlist
Default-deny outbound connections. Agents can only reach approved destinations — LLM APIs, sanctioned MCP servers. backboard.railway.app blocked.
Flows Governed
Compliance
Violations
Agent Permission Classification
Classify agents by permission level at session start. Elevated agents prohibited on repos with production credentials.
Flows Governed
Compliance
Violations
Sensitive File Boundary
Flows Governed
Compliance
Violations
Proxy-Routed Agent Traffic
Flows Governed
Compliance
Violations
Destructive Operation Gate
Flows Governed
Compliance
Violations
Credential Redaction
Intercepts every file read by the agent process and replaces credential patterns with REDACTED_BY_POLICY placeholders.
Flows Governed
Compliance
Violations
Destination Allowlist
Default-deny for outbound connections. Agents reach only LLM APIs, sanctioned MCP servers, and approved SaaS.
Flows Governed
Compliance
Violations
Sensitive File Boundary
Ring-fence credential stores. Alert or block agent access to paths likely to contain secrets before content scanning.
Flows Governed
Compliance
Violations
Destructive Operation Gate
Human-in-the-loop for irreversible actions. Destructive operations pause for explicit human confirmation.
Flows Governed
Compliance
Violations
Trust-Based Progressive Enforcement
Continuously scores agent behavior across the Lethal Trifecta. As risk accumulates, enforcement tightens automatically.
Flows Governed
Compliance
Violations
Proxy-Routed Agent Traffic
All agent outbound traffic must route through the enterprise security proxy. Direct connections blocked. Leverages existing proxy security stack.
Flows Governed
Compliance
Violations
Agent Permission Classification
Classify every agent by permission level at session start. Enforce org rules about which classifications are permitted per context.
Flows Governed
Compliance
Violations
Usage
Props
| Prop | Type | Default | Description |
|---|---|---|---|
| name | String | — | Policy name (required) |
| version | [String, Number] | '1' | Version label shown top-right |
| state | String | 'cool' | 'cool' (green, compliant) or 'hot' (red, violations) |
| size | String | 'big' | 'big' | 'med' | 'small' | 'micro' |
| description | String | '' | Policy description (shown in big + med) |
| lastUpdated | String | '' | Date string shown in big size only |
| regulations | String | '' | Regulation names shown in big size only |
| flowsGoverned | Number | — | Flow count (auto-abbreviated, e.g. 12000 → 12k) (required) |
| flowsData | Array<{count: number}> | [] | Sparkline data points for flows |
| compliance | Number | — | Compliance percentage 0–100 (required) |
| complianceData | Array<{count: number}> | [] | Sparkline data points for compliance |
| violations | Number | — | Violation count — turns red when > 0 (required) |
| violationsData | Array<{count: number}> | [] | Sparkline data points for violations |
| violationSamples | Array | [] | Violation records to display in an adjacent table. When non-empty, renders SecurityViolationsTable beside the card with a "Violation Samples X of Y" footer and Remediate button. |