4. Allowlist / denylist

Your own allow and deny patterns - the one filter that can pull the composite down.


Phase	1, static
Score	-1.0 on an allow hit, +3.0 on a deny hit
Source	`crates/grith-proxy/src/filters/allowlist.rs`
Config	`~/.config/grith/filters/allowlist.toml`, plus an optional `./config/filters/allowlist.toml`

Your own patterns. The denylist is checked first and an explicit deny always wins; the first matching entry decides, and the filter returns immediately.

This is one of three filters that can emit a negative score. An allowlist hit subtracts 1.0 from the composite:

terminal

$ grith proxy test '{"type":"FileRead","path":"/home/u/projects/api/.env"}'

Score:       5.0
Decision:    QUEUE (Medium)

Filter Breakdown:
  + path-match             3.0  [warning]  Access to environment file
  + sensitive-path-heuristic   3.0  [warning]  read access to environment file
  + allowlist             -1.0  [notice]  Path matches allowlist: */projects/api/.env

A denylist hit adds 3.0:

terminal

$ grith proxy test '{"type":"FileRead","path":"/home/u/projects/api/infra/main.tfstate"}'

Score:       7.0
Decision:    QUEUE (Critical)

Filter Breakdown:
  + path-match             4.0  [error]  Access to Terraform state file
  + allowlist              3.0  [error]  Path matches denylist: *.tfstate

⚠️It is a hint, not a bypass

-1.0 does not overturn a 5.0 path rule, and it cannot rescue a call from a capability deny or a canary hit. The allowlist argues for allow; the composite still decides.

The file

Entries live under [[allow]] and [[deny]]. Each has a pattern and an optional plugins list that scopes it to particular callers - omit it and the entry applies to everything.

~/.config/grith/filters/allowlist.toml

toml

[[allow]]
pattern = "*/projects/api/.env"

[[deny]]
pattern = "*.tfstate"

Patterns support a leading *, a trailing *, or both. A bare pattern matches exactly or as a path suffix, so .env matches any .env. A single * matches everything.

Where it is written from

The digest's allow always action appends an entry here for you - the exact path for a file call, *://host/* for a URL, the full command line for a shell call, address:port for a socket - scoped to the plugin that made the call. Duplicates are not re-added.

This is the one filter config file with a user-level layer. ~/.config/grith/filters/allowlist.toml is merged on top of ./config/filters/allowlist.toml if that exists; every other filter file resolves from the working directory or the copy embedded in the binary. Changes are read at daemon start, so restart the daemon after a hand edit.

4. Allowlist / denylist

The file

Where it is written from

See also