[Tool] Visual policy builder with enforce-by-default

[Qiu-LingYan]

OpenShell Policy Builder

I built a small community tool for generating network_policies YAML without hand-writing it:

• Repo: https://github.com/Qiu-LingYan/openshell-policy-builder
• Live: https://qiulingyan.top/openshell-policy-builder/

Why

The official default enforcement: audit logs but does not block — an agent can still perform write/delete operations under an "active" policy. It's an easy trap, especially combined with access: full (the official skill docs warn this "passes all traffic through, equivalent to a monitor-only policy").

This tool defaults to enforce and surfaces the gotchas in the UI:

• warning when protocol is unset (L4 only — rules/access have no effect)
• warning on tls: skip (disables L7 checks, credential injection, TLS termination)
• access presets annotated with their method sets (read-only: GET/HEAD/OPTIONS, read-write: + POST/PUT/PATCH)
• custom allow/deny rules editor with glob paths

What it is

Single-page, zero-dependency HTML/CSS/JS (no build step, no CDN), plus a tiny validate.py wrapper for openshell-prover check. Unofficial community tool, not affiliated with NVIDIA.

Feedback and issues very welcome — happy to iterate based on what the community needs.