Project
About Maelys Sandbox Policy
Why the project exists, what it guarantees and where it belongs in the Maelys ecosystem.A small language for strong boundaries
Maelys Sandbox Policy is the policy-contract layer of the Maelys execution stack. It turns a readable description of filesystem, network and process access into one canonical decision that can be reviewed, hashed, transported and enforced without depending on one operating-system sandbox.
Its governing idea is simple:
The world is sealed before the process is born. Nothing is decided after.
Why it exists
Sandbox launchers often mix human configuration, path resolution, operating-system flags and process lifecycle in one implementation. That makes policies difficult to compare and easy to weaken accidentally when another backend is added.
Sandbox Policy creates a stable boundary between decision and mechanism:
policy author or decision engine
│
▼
Maelys Sandbox Policy
readable → canonical
│
▼
Maelys Warden
resolve · enforce · attestPlace in the Maelys ecosystem
| Project | Role |
|---|---|
| Maelys Datalog | optional reasoning engine that can decide permissions from rules and facts |
| Maelys Sandbox Policy | portable representation and validation of the resolved decision |
| Maelys Warden | process lifecycle, backend selection, enforcement and receipts |
| Maelys Egress | authenticated mediated networking and destination enforcement |
Each product can evolve independently. Sandbox Policy does not depend on Datalog, does not spawn a process and does not implement a network proxy.
Design commitments
- deny-default filesystem semantics;
- strict parsing with unknown-key rejection;
- deterministic normalization and encoding;
- no silent capability downgrade;
- explicit ownership and bounded inputs in the C API;
- native C11 core with macOS, Linux and WebAssembly tooling;
- one SHA-256 identity over canonical policy bytes.
Project facts
| Language | C11 |
| Portable source | strict JSON v2 or C builder |
| Enforcement contract | canonical MIR v2 |
| Native targets | macOS Apple Silicon, Linux arm64 and amd64 |
| Browser target | WebAssembly playground and verifier |
| License | MIT |