/**
 * Dojo Policy Enforcement
 *
 * Loads and enforces role-based access control for Dojo tools.
 * Ensures AI callers can only access sandbox-safe operations.
 */
export type CallerRole = 'human' | 'mother' | 'ai';
export interface SandboxPolicy {
    fs_read: string[];
    fs_write: string[];
    exec_allowlist: string[];
    net: boolean;
}
export interface RolePolicy {
    description?: string;
    allowed_tools: string[];
    denied_tools?: string[];
    sandbox: SandboxPolicy;
    inherits?: string;
}
export interface SafetyPolicy {
    never_expose_to_ai: string[];
    always_sandbox_run: boolean;
    results_write_fence: string;
}
export interface DojoPolicy {
    roles: Record<string, RolePolicy>;
    default_role: CallerRole;
    safety: SafetyPolicy;
}
export interface PolicyCheckResult {
    allowed: boolean;
    reason?: string;
    sandbox?: SandboxPolicy;
}
/**
 * Load the Dojo policy from .decibel/dojo_policy.yaml
 * Falls back to default policy if file not found
 */
export declare function loadDojoPolicy(forceReload?: boolean): DojoPolicy;
/**
 * Check if a caller role is allowed to use a specific tool
 */
export declare function checkToolAccess(toolName: string, callerRole?: CallerRole): PolicyCheckResult;
/**
 * Get the sandbox policy for a caller role
 */
export declare function getSandboxPolicy(callerRole?: CallerRole): SandboxPolicy;
/**
 * Expand sandbox path patterns with actual Dojo root
 */
export declare function expandSandboxPaths(sandbox: SandboxPolicy, dojoRoot: string): SandboxPolicy;
/**
 * Check if a path is allowed for writing under the sandbox policy
 */
export declare function isWriteAllowed(targetPath: string, sandbox: SandboxPolicy): boolean;
/**
 * Check if an executable is allowed under the sandbox policy
 */
export declare function isExecAllowed(executable: string, sandbox: SandboxPolicy): boolean;
/**
 * Enforce tool access - throws if not allowed
 */
export declare function enforceToolAccess(toolName: string, callerRole?: CallerRole): void;
//# sourceMappingURL=dojoPolicy.d.ts.map