Skip to content
quoxcli

See the policies guarding your agents

Machine verified A machine ran this on our install and checked the result against the CLI. A test report is linked. CLI 0.3.1, checked 2026-10-17.

Which rules are my agents running under?

Ask for every governance policy, whether it blocks or only logs, and whether it is switched on. Then list them yourself.

What you get: the rules every agent action passes through, in one table, with the gaps called out.

Ask Quox

Section titled “Ask Quox”

Ask in plain words:

quox · talking to Quox

Which governance policies does my org have, and which of them are enabled?

▤ AOCL │ L1 identity complete · allowed · 0ms

▤ AOCL │ L3 policy gate complete · proceed · 5ms

◐ DELEGATE │ delegate_to_agent agent_id=auditus ✔ DELEGATE │ delegate_to_agent agent_id=auditus │ 1 tools used, 1 tool outcomes · 41.5s

⛓ AEE │ envelope opened · stream_success

Your org has 8 governance policies, and all 8 are enabled. AUDITUS confirmed this with a
live read.

Policy                                  │ Category   │ Effect
────────────────────────────────────────┼────────────┼─────────
Block Credential Exposure               │ safety     │ deny
Block Dangerous System Commands         │ safety     │ deny
Block SQL Injection Patterns            │ safety     │ deny
Rate Limit: Queries Per Hour            │ safety     │ deny
Rate Limit: Queries Per Minute          │ safety     │ deny
Warn: Elevated Privilege Commands       │ safety     │ log only
Warn: Production Destructive Operations │ safety     │ log only
Warn: PII Detected in Query             │ compliance │ log only

Five policies block the action (deny) and three only log it. Seven are safety policies
and one is compliance.

• No custom policies: All 8 are system defaults at version 1. Nobody in your org has
  written any. If you want controls specific to your org, such as data residency,
  retention or approval gating for particular tools, they would need adding.
• Thin framework coverage: Only three policies map to a compliance framework (SOC 2
  CC6.1 and ISO 27001 A.8.2.3, plus OWASP and CIS technical mappings). Nothing covers
  HIPAA, GDPR or the EU AI Act. AUDITUS can pull the template packs and recommend which
  to add if you need any of those.

53.5s · 1 tool · 0 approvals

A real turn on our own install (CLI 0.3.0, 15 Oct 2026), replayed at speed. Names changed. Type the same words into quox.
✔ Machine verified against the CLI on 15 Oct 2026 · test report mv9xxl

Quox handed the question to AUDITUS, the compliance agent, which read the policies live. Besides the table, it pointed out that every policy was a system default and which frameworks none of them cover.

Do it yourself

Section titled “Do it yourself”
policies 
quox governance policy listID                          Name                                       Category      Effect      EnabledPOL_1775932443176_q4d35c    Block PII Transmission to LLMs             compliance    deny        noPOL_1775932443173_n389p5    Block Credential Exposure                  safety        deny        yesPOL_1775932443172_mkgw9b    Block Dangerous System Commands            safety        deny        yesPOL_1775932443170_bbnqu6    Block SQL Injection Patterns               safety        deny        yesPOL_1775932443174_wt8tiy    Rate Limit: Queries Per Hour               safety        deny        yesPOL_1775932443173_3upk6i    Rate Limit: Queries Per Minute             safety        deny        yesPOL_1775932443175_wxqone    Warn: Elevated Privilege Commands          safety        log_only    yesPOL_1775932443175_ncthdm    Warn: Production Destructive Operations    safety        log_only    yesPOL_1775932443176_0vk2y6    Warn: PII Detected in Query                compliance    log_only    yes
From a real run on our own install, two days after the conversation above. One policy was added since, and it is switched off. Dates left out.
  • deny stops the action. log_only lets it through and records it.
  • Enabled says whether the policy is switched on.

quox governance policy get <id> shows one policy in full, and quox governance policy history shows who changed what.

What just happened

Section titled “What just happened”

Quox read your policies and changed nothing. Changing a policy can need a second person to sign it off, so one login cannot quietly loosen the rules.

Next

Section titled “Next”