Skip to main content

Policy Compliance

Checks your own CrabShield settings for gaps, so protection isn't weakened by accident.

What It Does​

Policy Compliance doesn't watch for attacks — it watches your settings. It regularly checks that CrabShield's own guards and safety settings are configured the way they should be, and flags it if something important has been turned off or weakened, whether that happened on purpose or by accident.

It's the equivalent of a smoke detector that also checks its own battery.

Why It Matters​

Security settings can drift over time — a guard gets disabled while troubleshooting something and never turned back on, or a setting gets loosened and forgotten. Without something watching for that, a gap in your protection could go unnoticed indefinitely. This guard makes sure you find out.

What It Checks​

A representative sample of what's covered:

  • Whether CrabShield itself, and its core guards (prompt injection, credential protection, filesystem restrictions, tool controls), are enabled
  • Whether authentication is required
  • Whether audit logging is turned on
  • Whether risky settings (like an unrestricted sandbox mode, or an unusually high session call limit) are in place

How It Responds​

Findings are graded by severity — critical, warning, or informational — and logged to your audit trail. A critical finding (like CrabShield being disabled entirely) also raises an alert.

Scenario

While debugging a connectivity issue, an admin temporarily disables the filesystem restriction guard and forgets to re-enable it. On its next check, Policy Compliance flags this as a critical finding — "Filesystem fence is disabled" — with a recommendation to re-enable it, surfacing the gap before it becomes a real problem.

Default Behavior​

Enabled by default, checking automatically in the background. You don't need to configure anything for it to run.