Skip to content
KernallDocs
Developer previewBack to Kernall
Browse documentation
Need a hand? Get in touch
DocumentationUse Kernall

Use Kernall

Configure policy

Choose destinations, sensitive data categories, and actions that always need a human.

The default policy

A newly created project
{
  "allowlistedDomains": [],
  "flaggedTypes": [
    "ssn",
    "credit_card",
    "bank_account"
  ],
  "requiresHumanActions": [
    "submit",
    "payment",
    "delete"
  ]
}

An empty allowlist permits all destinations. SSN, card, and bank-account detection trigger review by default. The action names submit, payment, and delete also require review.

How rules are evaluated

  1. Destination: a non-empty allowlist denies missing or uncovered destinations.
  2. Data: a detected category in flaggedTypes requires a human.
  3. Action: a name in requiresHumanActions requires a human.
  4. Otherwise: approve.

Allowlisted domains

Use hostnames such as example.com. The parser extracts a hostname from a URL, lowercases it, and removes leading www.. Entries cover exact hosts and subdomains: example.com allows api.example.com, but not example.com.attacker.test.

Paths, ports, and protocols are not separate boundaries. https://example.com/safe does not restrict access to the /safe path. Wildcards and denylist syntax are not supported.

This rule checks the supplied string. It does not observe redirects, DNS changes, or actual connections.

Sensitive data detection

CategoryPattern recognized
ssnThree digits, dash, two digits, dash, four digits.
credit_cardA coarse 13–16 digit pattern, optionally separated by spaces or dashes.
emailA conventional email-address pattern.
phoneA phone pattern built around a three-three-four digit layout.
bank_accountA run of 8–17 digits not claimed by an earlier pattern.

Only the first match is returned, in the order shown. These are coarse regexes, not identity, checksum, or comprehensive international-format validators. An unflagged first category can prevent a later flagged category from being considered.

Only data is scanned. Destination and task context are not scrubbed by these detectors.

Read and replace a policy

Read policy · local
curl --fail-with-body "$KERNALL_BASE_URL/api/policy"

Save your current policy before experimenting. Although the method is PATCH, all three arrays are required and the complete policy is replaced.

Require an allowlisted destination
# Local development: replaces all three policy fields.
curl --fail-with-body -X PATCH "$KERNALL_BASE_URL/api/policy" \
  -H 'Content-Type: application/json' \
  -d '{
    "allowlistedDomains": ["example.com"],
    "flaggedTypes": ["ssn", "credit_card", "bank_account", "email", "phone"],
    "requiresHumanActions": ["submit", "payment", "delete"]
  }'

This policy permits example.com and its subdomains as destinations. Other hosts are denied before review rules are checked. Test changes with a new idempotency key.

SettingValidation
allowlistedDomainsAt most 100 strings; each at most 253 characters before hostname normalization.
flaggedTypesAt most 5 entries from the supported category names.
requiresHumanActionsAt most 100 non-empty strings; each at most 64 characters; lowercased.

To restore defaults, PATCH the full default JSON above. Changes affect new evaluations, not existing verdicts or confirmations.

What about kernall.yaml?

The earlier homepage YAML is a future configuration concept. The current server does not load or enforce kernall.yaml. Use the JSON policy API. Filesystem, secret, and runtime permissions need a separate schema when implemented.