Example Policies

# policies/global.yaml

- name: Global App Config
  type: app_config
  scope: global
  locked: false
  data:
    flow_logs_enabled: true
    suppress_frontend_ui: false
    telemetry_enabled: true

- name: Global Flow Config
  type: flow_config
  scope: global
  locked: false
  data:
    enabled: true
    categories:
      - SECURITY_BLOCK
      - BANKING
      - CRYPTO
      - EMAIL
      - SOCIAL_MEDIA
      - PRODUCTIVITY

- name: Global DLP
  type: dlp_config
  scope: global
  locked: false
  data:
    enabled: true
    targets:
      apply_to_all_apps: true
    detections:
      builtins: [credit_card, ssn_us, email, phone]
    actions:
      mode: warn
      allow_once_override: true
    ui:
      notify_on_warn: true
      toast_cooldown_sec: 30

# policies/finance.yaml

- name: Finance DLP
  type: dlp_config
  scope: group
  target: finance
  locked: true
  data:
    enabled: true
    targets:
      apply_to_all_apps: true
    detections:
      builtins: [credit_card, ssn_us, email, phone]
      custom_regex:
        - name: account_number
          pattern: '\b[0-9]{8,17}\b'
    actions:
      mode: block
      clear_clipboard_on_block: true
      allow_once_override: false
    ui:
      notify_on_block: true
      toast_cooldown_sec: 0
    slack_context:
      enabled: true
      categories: [external_shared, public_channel]

# policies/engineering.yaml

- name: Engineering DLP
  type: dlp_config
  scope: group
  target: engineering
  locked: false
  data:
    enabled: true
    targets:
      apps_allowlist:
        - Terminal
        - iTerm2
        - Warp
        - Code
        - Cursor
        - Postman
        - TablePlus
    detections:
      builtins: [credit_card, ssn_us]
    actions:
      mode: warn
      allow_once_override: true
    ui:
      notify_on_warn: true
      toast_cooldown_sec: 60

# policies/restricted.yaml

- name: Restricted DLP
  type: dlp_config
  scope: group
  target: restricted
  locked: true
  data:
    enabled: true
    targets:
      apply_to_all_apps: true
    detections:
      builtins: [credit_card, ssn_us, email, phone]
      custom_regex:
        - name: account_number
          pattern: '\b[0-9]{8,17}\b'
        - name: passport_number
          pattern: '[A-Z]{1,2}[0-9]{6,9}'
    actions:
      mode: block
      clear_clipboard_on_block: true
      allow_once_override: false
    ui:
      notify_on_block: true
      toast_cooldown_sec: 0
    slack_context:
      enabled: true
      categories:
        - public_channel
        - private_channel
        - external_shared
        - dm
        - group_dm
        - context_unavailable

# policies/stealth.yaml

- name: Stealth App Config
  type: app_config
  scope: global
  locked: true
  data:
    stealth_mode: true
    suppress_frontend_ui: true
    suppress_email_content_analysis: false
    flow_logs_enabled: true
    telemetry_enabled: true

charley/
├── groups.yaml
└── policies/
    ├── global.yaml
    ├── finance.yaml
    ├── engineering.yaml
    └── restricted.yaml

# charley/groups.yaml
- name: finance
  description: "Finance team"
  members:
    - finance-lead@yourcompany.com

- name: engineering
  description: "Engineering team"
  members:
    - eng-lead@yourcompany.com

- name: restricted
  description: "Legal, HR, executive"
  members:
    - legal@yourcompany.com
    - hr@yourcompany.com

# Preview before merging to main
agent-charley-cli plan --file charley/policies/ --groups charley/groups.yaml

# Apply on merge
agent-charley-cli apply --file charley/policies/ --groups charley/groups.yaml --prune -y

# .github/workflows/agent-charley-cli.yml
name: Charley Policy

on:
  pull_request:
    paths: ['charley/**']
  push:
    branches: [main]
    paths: ['charley/**']

jobs:
  plan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with: { python-version: '3.12' }
      - run: pip install charley_policy-0.1.0-py3-none-any.whl
      - run: agent-charley-cli plan --file charley/policies/ --groups charley/groups.yaml
        env:
          CHARLEY_API_KEY: ${{ secrets.CHARLEY_API_KEY_RO }}

  apply:
    if: github.ref == 'refs/heads/main'
    needs: plan
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with: { python-version: '3.12' }
      - run: pip install charley_policy-0.1.0-py3-none-any.whl
      - run: agent-charley-cli apply --file charley/policies/ --groups charley/groups.yaml --prune -y
        env:
          CHARLEY_API_KEY: ${{ secrets.CHARLEY_API_KEY }}