Policies

Workspace policy selects how admission responds to a conflict or an enforcement gap. It is declared in .majlis/majlis.toml:

[policy]
revision = 1
edit = "block"
intent = "warn"

An omitted policy defaults to revision 1, edit = "block" and intent = "warn".

The three actions

Action	Result
warn	Continue with a recorded gap, where the applicable contract allows it.
ask	Pause into a needs-you item. Outage, overload, invalid identity and timeout deny.
block	Deny. Outage, overload, invalid identity and timeout also deny.

Missing daemon, overload, invalid identity and unsupported capabilities all follow this table. Strict modes never fail open, and a denial is never silently downgraded to success.

A conflict accepted under trusted warn records a bounded, durable execution gap without acquiring the contested lease. The caller must still pass the final durable start check before executing.

Policy is untrusted until reviewed

Configuration declares policy; it does not grant authority. A human operator reviews the exact file bytes and accepts their hash:

majlis policy show
majlis --operator policy accept --config-hash <reviewed-sha256> \
  --revision <reviewed-policy-revision> --edit block --intent warn \
  --reason '<review-reason>' --idempotency-key '<operation-key>'

Comments and whitespace change the hash. Changed bytes at an accepted revision require the next revision. Lowering enforcement needs another explicit acceptance; repository messages and environment variables cannot authorize it. There is no MAJLIS_ADMISSION_DEFAULT override.

Majlis policy sits alongside your harness’s own approvals and never replaces them. See Reviewing policy.