Rules / CFG025

CFG025 custom organisation policy (require-deny / forbid-allow)

Severity: error OWASP: LLM03:2026 – Excessive Agency

What cfgaudit checks

CFG025 enforces an organisation's own permission policy, declared in .cfgaudit.yml. Unlike the other rules (which encode universal CVE/hardening checks), CFG025 is inert until you configure a policy: section. It evaluates against the project's permissions.allow / permissions.deny.

# .cfgaudit.yml
policy:
  # Commands that MUST be blocked by permissions.deny.
  require-deny:
    - "Bash(git commit:*)"
    - "Bash(git push:*)"
  # Commands that MUST NOT be grantable by permissions.allow.
  forbid-allow:
    - "Bash(git commit:*)"
    - "Bash(curl:*)"

require-deny → error when no permissions.deny entry covers the command. This is the strong guarantee: in Claude Code deny beats allow, so a covered deny actually blocks it.
forbid-allow → error when any permissions.allow entry grants the command (in whole or part).

Containment-aware matching

Matching is not a plain string compare — broader patterns subsume narrower ones:

Policy target	`require-deny` satisfied by a deny of	`forbid-allow` violated by an allow of
`Bash(git commit:*)`	`Bash(git commit:)`, `Bash(git:)`, `Bash(*)`	`Bash(git commit:)`, `Bash(git:)`, `Bash(*)`, or any `Bash(git commit …)`

So a narrower deny (Bash(git commit --amend)) does not satisfy require-deny: Bash(git commit:*), while any allow that grants even one git commit invocation violates forbid-allow.

Evaluated against the project settings.json (the committed artifact a CI policy applies to).

Example: "Claude may never run commit/push"

policy:
  require-deny: ["Bash(git commit:*)", "Bash(git push:*)"]
  forbid-allow: ["Bash(git commit:*)", "Bash(git push:*)"]

Limitation

Matching covers the common Claude Code permission shapes (Tool(cmd), Tool(cmd:*), Tool(cmd *), Tool(*)). Exotic glob forms inside the body are not interpreted.

References

.cfgaudit.yml configuration — see the README
Related built-in deny-coverage rules: CFG006 (deny absent), and the planned #74–#77 (deny should cover secrets/keys)

Documentation for cfgaudit 1.18.1. Source of this page · Rule implementation