Pages
Policy Config — No Root Execution
Source: c65 policy-definitions.md P3 — toggle + exceptions shape
‹ Policy Catalog
No Root Execution
Agents may not execute with root or admin privileges. Everything else's blast radius is bounded by this policy.
Identity & Access
high
P3Satisfies
OWASP LLMATLASCSF 2.0ISO 27001SOC 2
OWASP LLMATLASCSF 2.0ISO 27001SOC 2Underlying control— show
run: labels has "root-user"edit as custom control →1 agent running as root right now
claude-code on infra-bastion under root — not covered by an exception. The blast radius of every other policy is bounded by this one.
Exceptions
Scoped carve-outs with a reason and an expiry — accepted risk, on the record.
| Scope | Value | Reason | Expires | |
|---|---|---|---|---|
| host | build-runner-7 | Container entrypoint requires uid 0 — remediation tracked in INFRA-412 | 2026-10-15 | |
Remediation shown on findings: Re-run the agent as an unprivileged user; grant narrow capabilities instead of root.