{
  "schema": "https://ai-atoms.com/schemas/policy-v1.json",
  "type": "policy",
  "id": "policy/no-cross-project-access",
  "version": "1.0.0",
  "name": "No cross-project access",
  "description": "Refuses read or write outside the declared project root. Prevents cross-tenant or cross-workspace leakage.",
  "subtype": "boundary",
  "effect": "forbid",
  "rule": {
    "text": "Do not read files outside the declared project root. Do not write files outside the declared project root. Do not exec commands that would traverse outside the project root. If a task requires cross-project context, escalate with the specific paths and rationale.",
    "boundary_type": "role-refusal",
    "refusals": [
      "Do not read files outside the declared project root.",
      "Do not write files outside the declared project root.",
      "Do not exec commands that would traverse outside the project root.",
      "If a task requires cross-project context, escalate with the specific paths and rationale."
    ],
    "escalate_to": "agent-atoms://atoms/persona/devops-engineer"
  },
  "authored_by": "convergent-systems-key",
  "source_url": "https://github.com/convergent-systems-co/agent-atoms/blob/main/atoms/role-boundary/no-cross-project-access.json",
  "category": "governance",
  "provenance": {
    "source": "convergent-systems-co/agent-atoms",
    "source_url": "https://github.com/convergent-systems-co/agent-atoms/blob/main/atoms/role-boundary/no-cross-project-access.json",
    "author": "convergent-systems-co",
    "license": "Apache-2.0",
    "notes": "Re-typed from role-boundary by scripts/migrate-policy-tool.py."
  },
  "lifecycle": "stable"
}