Keep named files with the models you chose

Some files should reach only a model you chose. An information-flow rule names a source, such as everything under secrets/, and the destinations its content may go to. Once a session has read that source, Clio Coder refuses to send the conversation anywhere else, in every permission mode.

Declare a source and where it may go

This policy keeps anything read under secrets/ on one local model target:

version: 1
informationFlow:
  targets:
    local:
      runtime: llamacpp
      endpoint: http://127.0.0.1:8080/v1
  recipients:
    private-models: ["target:local"]
  sources:
    - id: secrets-local
      paths: [secrets/]
      recipients: ["group:private-models"]

A target is pinned by runtime and endpoint, so pointing the same name at another URL does not keep the approval. A source can also be a tool or an MCP server, and recipients: [] means the content may go nowhere.

Review and approve

1. 01

   Show what would be approved

   Shell

   clio-coder config trust safety

   This prints the policy files, their digest, and the exact approval command. It changes nothing.

2. 02

   Approve those exact bytes

   Shell

   clio-coder config trust safety --hash <reviewed-sha256>

   Approval belongs to this workspace and this content. Restart Clio Coder to load it.

An edit you have not approved can only restrict more: a new, unapproved rule labels content and allows no destination.

What happens in a session

Reading secrets/notes.txt labels the session with secrets-local. Requests to the pinned local target continue. Switch to a cloud model and the next request is refused before it is sent, with the rule, the source, and the allowed destinations named.

The label follows the session through summaries, compaction, resume, branches, and worker results. Changing the model, the policy, or the permission mode does not clear it. To work without it, start a new session.