Manage a service's execution policy
A service’s execution policy is the boundary every plan is checked against: where in the repository work may happen, which commands are approved, which paths are protected, which CI checks are expected, and which AI capabilities are enabled. It is revisioned and content-hashed.
The post-enrollment checklist
Section titled “The post-enrollment checklist”The Policy tab shows five steps. Each is complete when the value is recorded, and otherwise asks you to confirm what Helmhive detected deterministically from the repository (Makefile targets, package scripts, workflow files, and common infrastructure directories):
| Step | Recorded when |
|---|---|
| Description | A service description exists for request and review context. |
| Commands | Approved command names (install, format, lint, typecheck, test, build) map to exact shell commands. Commands run without network access, so an install command must work from what the runner image already contains. |
| Expected checks | Required CI job names are recorded, as they appear in the repository’s workflow files (for example backend-unit). |
| Protected paths | Path patterns such as infra/** or .github/workflows/** are recorded. |
| Repository access | Repository read authority is enabled, which planning and implementation require. Enrollment grants it whenever the source reports it, so this step is usually already complete. |
Detected values are a proposal. Nothing is applied until you save it.
Edit the policy
Section titled “Edit the policy”Under Repository policy additions:
- Service description updates only the service context and does not create a policy revision.
- Command additions take one
name=commandper line. Only the six command names above are accepted, and each command is later the only form a plan may declare as a check. - Protected path additions and Expected check additions take one entry per line. Paths must stay within the repository root and be unique.
- Enable repository read authority appears until it is granted.
Save policy additions opens a confirmation, Revise execution policy. Read it carefully: queued implementation jobs for the service are cancelled and running jobs are asked to stop, because every existing plan was bound to the previous revision and is now stale.
AI capabilities
Section titled “AI capabilities”A service policy lists which AI capabilities are enabled: repository:read (read repository
context), change:plan, change:implement, branch:create, and pull_request:create. The
repository source’s detected capabilities are the ceiling; a capability the source does not
report cannot be enabled.
How plans use the policy
Section titled “How plans use the policy”- A plan may declare only checks that are exact commands from the policy.
- Every affected path that matches a protected path pattern must be declared in the plan’s protected-path impact.
- Planning requires
repository:readandchange:plan; implementation requireschange:implement; opening a pull request requiresbranch:createandpull_request:create. Capabilities the source does not report cannot be enabled.