Command Runner

Command Runner is the policy resource every run activity is gated by. It decides which executables may run, which directories they may run in, what environment they see, and how long they may take.

Nothing in this group executes without one. Run Command, Run Bash Script, and Run PowerShell Script each select a Command Runner, and a request that falls outside its allow-lists does not run.

The resource has four tabs: Configuration, Allow-lists, Environment, and Limits.

Configuration

Field	Required	Description
Name	Optional	Name of the resource.
Description	Optional	Description of the resource.

Allow-lists

Field	Required	Description
Allowed Commands	Optional	Executables permitted to run, for example bash, python3, pwsh. A command is matched on its executable name.
Allowed Paths	Optional	Permitted working directories and script roots.

warning

An empty Allowed Commands list denies everything. The allow-list is the control that makes this group safe to expose — it is not an optional filter.

Allowed Paths

A resolved working directory or script path must canonicalize to a descendant of one of these entries, which blocks ../ escapes. The first entry is the default working directory when a run activity does not set one.

Environment

Field	Required	Description
Environment Variables	Optional	Environment variables applied to every child process.

Values are mapping and vault capable. Store secrets in a vault variable rather than as literal text.

Limits

Field	Required	Description
Max Runtime (seconds)	Optional	Hard wall-clock cap per run. Defaults to 300.
Max Output Bytes (per stream)	Optional	Cap on captured stdout and stderr bytes. Defaults to 1048576.

Max Runtime (seconds) force-kills the process and its descendants once exceeded.

Max Output Bytes (per stream) truncates output beyond the cap rather than buffering unbounded. When truncation occurs, the run activity reports truncated as true.