Credential Reads Should Always Deny

The Confused Deputy Problem

Agents routinely attempt to read configuration files, API keys, and environment files. Sometimes the intent is benign — the model wants context. Sometimes it is not. You cannot reliably distinguish intent at runtime with an LLM.

ActantOS uses deterministic labels: credential_access=true on the normalized action facts. Cedar policy forbids it. The decision is deny with reason_code=policy_forbid.credential_path.

Never Route Credentials to Approval

A common mistake in governance design is treating credential access as 'high risk, send to human.' That creates approval fatigue and trains approvers to click through sensitive reads.

ActantOS Rule 8 from the implementation spec: credential_access=true is always deny, never approval_required.

Prove It in the Demo

The enforcement demo script explicitly tests guarded_read(".env") → denied. If your governance layer allows credential reads after approval, you have a policy bug — not a feature.

Try it: Quickstart · Early MVP