The Guardian reviewer

Red-team lab (Module 10, L10.3, interview checkpoint): review the arguments, then fail closed. Of 4 suite rows the naive reviewer ALLOWs 3 and the hardened Guardian DENYs 4. The traversal normalises to /.ssh/authorized_keys. /workspace-evil is ALLOW under startswith(scope) and DENY once the rule requires a slash boundary. The unlisted argument mode=overwrite on fs.write is naive ALLOW and hardened DENY. A reviewer exception is ALLOW when it fails open and DENY when it fails closed. In-memory proposals only; no threads, model or provider call.

This Harness Engineering lesson is part of a paid plan. Sign in with a plan that includes this course to read it.