Static guardrails
Dangerous reads cannot be expressed: Secrets and non-OCM kinds are absent from the allow-list, so they are refused before any API call.
An MCP server that lets AI agents operate a multi-cluster Kubernetes fleet through an Open Cluster Management hub. The agent never holds a kubeconfig. Every write is policy-checked, human-approved, and traced.
Each gate can refuse on its own. A change reaches the fleet only by satisfying all four.
Each one can refuse independently. A request has to satisfy all of them, and the two policy layers are tested against a shared fixture corpus to prove they agree.
Dangerous reads cannot be expressed: Secrets and non-OCM kinds are absent from the allow-list, so they are refused before any API call.
An independent second opinion in dry-run. A parity contract asserts it reaches the same verdict as layer 1 on every fixture.
Writes are two-phase. An Ed25519 token, minted by a person out of band, binds the exact content hash and expires.
No Secret reads, no exec, no arbitrary delete — enforced by the hub itself, not by the server asking nicely.
Why it exists, how it works, and what it refuses to automate — in order.
Architecture, deployment paths, the full tool surface, and the threat model.