Start from a familiar workload, understand its boundary and compile a real portable policy in your browser.
You do not need to know the policy language before using this page. Begin with the task you want to run; the playground shows the permissions that task needs and turns them into a portable sandbox decision.
What the manifest controls
Every example answers the same four questions:
what starts closed by default;
which project or temporary files may be read or changed;
whether networking is blocked or limited to named destinations;
whether child processes must stay inside the boundary.
The manifest is not the sandbox itself. It is the readable contract that Warden must enforce when it later starts the program.
Use Build a project for a compiler, Audit source code for a read-only scanner, Install dependencies for controlled registry access, or Run a generator for a tool that may write only one output directory. Selecting an example replaces the editor contents; you can then adjust it freely.
POLICY WORKSHOPDescribe the boundary before the program starts
Loading runtime
Choose a familiar task, inspect the permissions it needs, then compile a policy you can enforce.
Build limits
document=1 MiB
filesystem rules=4096
path bytes=4096
network destinations=1024
hostname bytes=253
json depth=32
Use case
Read the project and write only to a prepared build directory, without network access.
Your boundary is ready to reviewCompile it to see the normalized decision and download the portable policy file.
Read the result before downloading it
The readable decision shows what the compiler understood after normalization. The binary policy is the exact file Warden consumes. Its decision fingerprint lets receipts, caches and reviewers refer to those exact permissions without relying on the original JSON formatting.