# Class LittleGhost::Sandbox::Policy

Documentation version: Edge

Canonical HTML: https://littleghostai.org/docs/LittleGhost/Sandbox/Policy.html

Normalizes requested filesystem, process, environment, and child-network
controls into one immutable policy. Policy is a declaration, not proof of
isolation; the selected backend exposes #effective_policy and rejects controls
it cannot enforce.

## Inheritance

`LittleGhost::Sandbox::Policy < Object`

## Attributes

<a id="attribute-i-environment"></a>
### `environment` (R)

Environment inheritance and explicit values.

<a id="attribute-i-files"></a>
### `files` (R)

Named Workspace paths visible to tools and child processes.

<a id="attribute-i-network"></a>
### `network` (R)

Network policy, or `nil` for a backend-specific secure default.

<a id="attribute-i-root_filesystem"></a>
### `root_filesystem` (R)

Requested host-root access: `:isolated`, `:read_only`,
or `:read_write`.

<a id="attribute-i-runtime_paths"></a>
### `runtime_paths` (R)

Named workspace paths visible only to sandboxed processes.

## Class methods

<a id="method-c-coerce"></a>
### `.coerce`

```ruby
.coerce(value = nil, **options)
```

Returns an existing policy or builds one from a Hash and keyword options.

<a id="method-c-new"></a>
### `.new`

```ruby
.new(files: {root: :read_only},
        runtime_paths: {},
        root_filesystem: :isolated,
        environment: {},
        network: nil)
```

Builds a backend-independent policy from named Workspace paths.

## Instance methods

<a id="method-i-workspace_writable-3F"></a>
### `#workspace_writable?`

```ruby
#workspace_writable?()
```

Whether the `:root` entry in `files` requests
`:read_write` access.