[proxy]

Scoring thresholds, the filter switches, and the four behavioural knobs that change what fires.

Two numbers decide every call: allow at or below auto_allow_threshold, deny above auto_deny_threshold, queue in between.

Key	Default	What it does
`auto_allow_threshold`	`3.0`	A composite at or below this is allowed silently.
`auto_deny_threshold`	`8.0`	A composite above this is denied. 8.0 itself queues.
`review_timeout_seconds`	`300`	How long a queued call in `grith run` or the REPL waits before it is denied. A supervised `grith exec` session uses `supervisor.freeze_timeout_seconds` instead.

Both comparisons are strict, on both ends. Validation refuses auto_allow_threshold at or above auto_deny_threshold, and either outside 0.0-10.0.

Quieter, and less safe

toml

[proxy]
auto_allow_threshold = 4.0
auto_deny_threshold = 8.0

Raising auto_allow_threshold moves calls out of the queue and into silent allow. Lowering auto_deny_threshold moves calls out of the queue and into silent deny. There is no setting that makes grith quieter without also making it less careful in one direction or the other. See Tuning scoring thresholds for the walkthrough and Composite scoring for how a score is built.

Filter switches

All 18 filters are on by default. Every section below is an off switch and nothing more: apart from the four [proxy.filters.behavioural] tunables, only enabled is read, and a filter's rules, patterns and scores live in filter config files or in the binary, not here. Note that [proxy.destructive_action] sits alongside [proxy.filters] rather than inside it.

Section	Turns off
`[proxy.filters.reputation]`	The destination reputation filter, and the load of `domains.toml`.
`[proxy.filters.taint]`	Taint tracking.
`[proxy.filters.rate_limit]`	Rate limiting.
`[proxy.filters.egress]`	Egress policy and egress rate - one switch, two filters.
`[proxy.filters.session_containment]`	Session containment. ANDed with the `enabled` key in `containment.toml`.
`[proxy.destructive_action]`	The destructive-action filter.

[proxy.filters.behavioural] is the one filter section with real tunables:

Key	Default
`enabled`	`true`
`min_calls_for_baseline`	`200`
`mild_deviation_score`	`1.0`
`significant_deviation_score`	`3.0`

Behavioural knobs

Four keys outside [proxy.filters] change what fires rather than whether a filter runs.

toml

[proxy.spawn]
routine_provenance_signal = false
taint_data_flow_only = true
taint_outbound_requires_data_flow = true

[proxy.rate_limit]
risk_gated_burst = true

taint_data_flow_only (on) - a spawn under session taint only scores when argv, env, fd lineage or a shell pattern shows the tainted data actually reaching it. With it off, any active taint adds 3.0 to every spawn, which is what used to flag reading ~/.npmrc and then running npm install.
taint_outbound_requires_data_flow (on) - narrows the same rule for outbound-capable binaries, so aws s3 ls after reading ~/.aws/credentials does not fire on the pairing alone. Genuine exfiltration of the tainted data still does.
risk_gated_burst (on) - the rate-limit filter's volume penalties only apply to operations carrying a risk signal. A burst of routine file churn in ~/.cache or .git/ never escalates. Turning it off restores a frequency-blind burst counter and forfeits those exemptions.
routine_provenance_signal (off) - a provenance-backed reduction for routine spawns. Off by default.

Turning the first three off makes grith noisier, not safer: each exists because it removed a class of false positive without removing a detection.

[proxy]

Filter switches

Behavioural knobs

See also