Blog / BABYLON-60
A text rule does not confine a process
An agent’s policy and the effective permissions of its process require different checks.
Check who can open the resource
Writing that an agent should only read a directory does not remove write permission from its process. Evaluating that boundary requires attempting the operation from the process that executes tools, using its actual credentials and descriptors. If an alternative path still reaches the resource, a correct broker is insufficient to mediate every action. This distinguishes a policy expressing an intention from a mechanism that restricts the operations a process can actually perform.
State the platform and its limits
Operating-system controls have specific interfaces, versions and limits. Landlock, for example, can restrict process rights on Linux, but its documentation distinguishes capabilities by ABI version and describes already-open resources and operations outside its coverage. A test on one platform does not establish behaviour on another. Calling a user-space component a kernel is insufficient too: a useful account states where a decision is enforced, which processes it affects and which accesses remain outside its scope.
Observe denials as well as configuration
A reproducible check pairs an allowed case with accesses that must be denied: an out-of-scope write, a child process or use of an inherited descriptor, depending on the profile being evaluated. Record the command, system version and observed outcome without treating a partial list as universal coverage. Evidence should distinguish policy failure, an operating-system denial and the effect on the file. A configuration screenshot or a statement of intent cannot substitute for those observations.