Managing centralised guardrail policies for coding agents
Each coding harness has its own permission system. A Tuff policy declares deny and ask rules once, compiles them into the native rules of Claude Code, Codex, and OpenCode, records the rules an agent cannot enforce, and fails tuff check when a compiled rule is removed.