Watch policies and permissions
Deny-by-default responses, explicit playbooks, approvals, and the kill switches — nothing runs without your say-so.
Last updated · September 2026
On this page
The watcher is read-only. It cannot change your server — not by bug, not by model suggestion. The only things that can act are named playbooks you explicitly authorized, and every run is logged locally and reported to your account.
The policy file
Policy lives at ~/.bolt/watch/policy.json on the watched machine (mode 600). bolt watch policy show prints it; subcommands change one knob at a time. Corrupt or missing policy boots to safe defaults: checks on, everything authorized off.
| Knob | Effect |
|---|---|
| enable / disable | Master switch. Disabled watchers check nothing. |
| interval | Seconds between checks (60–3600). |
| signal <name> on|off | Toggle auth, ports, files, or resources individually. |
| threshold <name> <n> | Tune authFails, loadMult, diskPct, memPct. |
| triage <n|off> | Max AI triages per day (server quota applies on top). |
| phonehome on|off | Whether summaries leave the box at all. Off means local-only: no email, no inbox. |
Playbooks: the only things allowed to act
| Playbook | What it does | Auto-fires? |
|---|---|---|
| blockIp <ipv4> | Deny one public IP at the host firewall (ufw, iptables, or firewall-cmd). RFC-1918 and loopback targets are refused — blocking those locks you out, not the attacker. | Only this one, only on auth bursts, only when allowed. |
| killPid <pid> | SIGTERM one process. Never pid 1, never the watcher itself. | Never — run bolt watch respond killPid <pid> yourself. |
| restartService <name> | systemctl restart one plain-named service. | Never — run it yourself via respond. |
Authorize with bolt watch playbook <name> allow, revoke with off. Authorization is a deliberate typed command on the machine — a model suggestion, an alert, or an email can never flip it. Manual runs (bolt watch respond) need the same authorization first.
Kill switches
- bolt watch stop ends the daemon on the machine.
- bolt watch policy disable stops checks without uninstalling.
- Disabling the host in your account makes the next phone-home answer disabled:true and the daemon exits by itself.