Policies

Policy statements are allow / deny rules that TF Code evaluates before sensitive operations. They complement the permission system: permissions control what requires approval, policies control what is permitted at all.

Policies can be defined locally in tfcode.json or pulled from your ToothFairyAI workspace during sync — the latter is how enterprises enforce a baseline across every developer.

Actions

Action	Evaluated when	Resource examples
provider.use	A model from a provider is selected	anthropic/*, openai/gpt-4o
tool.use	A built-in or synced tool is made available	bash, tf_tooling, webfetch
mcp.connect	An MCP server starts	github, my-server/*
skill.load	A skill is loaded into context	deploy, frontend-review

Resources support * wildcards (anthropic/*, tf_*).

Local statements

Add a policies array to any tfcode.json:

{
  "policies": [
    { "effect": "deny", "action": "tool.use", "resource": "bash" },
    { "effect": "deny", "action": "provider.use", "resource": "openai/*" },
    { "effect": "allow", "action": "skill.load", "resource": "deploy" }
  ]
}

Workspace statements

Running tfcode sync also pulls the workspace's policy file (stored as a workspace document alongside your tools) and caches it locally at ~/.tfcode/policy[-<profile>].json (mode 0600). Workspace statements are read-only and refreshed on every sync.

note

When no policy file exists in the workspace, sync reports it as "unavailable" and continues — nothing is enforced from the workspace side.

Evaluation order

Statements are evaluated local-first, workspace-last, and the last matching statement wins — so a workspace deny always overrides a local allow, and vice versa:

local tfcode.json  →  workspace (synced)  →  final decision

No matching statement means allowed (unless a stricter permission applies).

Inspect what is currently active:

tfcode policy
# Local statements (tfcode.json):
#   [deny] tool.use bash
#
# Workspace statements (synced):
#   [deny] provider.use openai/*

Examples

Lock down a CI/devcontainer image to read-only tooling:

{
  "policies": [
    { "effect": "deny", "action": "tool.use", "resource": "bash" },
    { "effect": "deny", "action": "tool.use", "resource": "edit" },
    { "effect": "deny", "action": "mcp.connect", "resource": "*" }
  ]
}

Force a company-approved model catalog:

{
  "policies": [
    { "effect": "deny", "action": "provider.use", "resource": "*" },
    {
      "effect": "allow",
      "action": "provider.use",
      "resource": "toothfairyai/*"
    }
  ]
}

Related

• Permissions — ask/allow/deny approval rules
• Workspace Sync — where workspace policies come from