Skip to main content

Semi-Autonomous Policy

Semi-autonomous policy lets the agent execute certain actions without operator approval, based on rules you configure for the realm. Instead of approving every action by hand, you set a trust level, a scope of targets, and exception rules that decide what runs automatically and what still waits for your sign-off.

At a glance​

  • What it is — realm-scoped rules that let the agent auto-execute certain actions instead of waiting on operator approval.
  • When to use it — let the agent auto-run low-risk actions instead of pausing for every step, or restrict autonomy to a well-defined scope.
  • Inputs — a trust-level preset (Cautious/Balanced/Aggressive) or custom policy (intrusiveness ceiling, enabled tools, browser mode), Trusted Targets, optional Infrastructure Allowlist, exception rules, optional natural-language intent via Configure.
  • Outputs — an effective policy that auto-executes allowed actions and queues other actions for approval in Semi; saved exception rules; an optional per-operation override.
  • Related objects — Operations, Notifications, Realms, Automations.
  • Common actions — Customize, Save, Add (a trusted target), Enable/Disable (an exception rule), Delete.
  • API / tool links — use Realm Settings to manage the realm policy, or the MCP operation controls to change autonomy for one operation.

How it works​

By default, every action waits for operator approval. In Semi, the policy evaluates each proposed action against your settings and queues actions it does not allow for approval. Whether an action auto-executes depends on its intrusiveness, the tool it uses, and whether its target is in scope. Cracken checks each action against the autonomy policy before it runs, and checks browser actions again after they run (see Browser actions).

Policy is realm-scoped — it supplies the action checks for Semi operations in the realm. You can also override the policy for a single operation from inside that operation (see Per-operation override).

Trust level​

A trust-level slider sets the autonomy preset. There are three presets:

  • Cautious — web research, Cybergraph and REST API calls; shell, Python, browser and filesystem disabled. Best for unfamiliar targets.
  • Balanced (default) — safe reconnaissance auto-runs; scans and mutations need approval. The default for new realms.
  • Aggressive — scoped exploits auto-run; only destructive actions need approval. Requires a well-defined scope.

Each preset combines an intrusiveness ceiling with a set of enabled tools and a browser mode. Select a preset as a starting point, then either fine-tune it with the Custom Policy builder or let it adapt over time through exception rules.

Custom Policy​

To go beyond the presets, select Customize to switch the Trust Level card into Custom Policy mode. A custom policy exposes:

  • Auto-approve up to — the intrusiveness ceiling. Actions at or below this level execute automatically.
  • Enabled tools — checkboxes for Bash, Python, Browser, Web Search, and MCP Tools.
  • Browser Mode — Evidence Only or Interactive.

Beyond the checkboxes above, Cybergraph, Filesystem (file read, write, edit, glob, and grep), and REST API access are also part of the policy. They are enabled by default; adjust them through the Configure playbook, which can also report a capability's current state.

Save or discard the changes from the buttons that appear. Select Switch to preset to return to the slider.

To turn an intent into custom settings without configuring each field, expand Describe what you need, type what you want, and select Configure playbook. This is one of the two Configure entry points.

Trusted Targets​

Trusted Targets is the scope — the domains and IPs that actions can target automatically. Add entries by hostname, IP, CIDR range, or wildcard domain (for example example.com, 10.0.0.0/8, or *.internal.io).

With no trusted targets, Semi queues actions targeting external hosts for approval. When the agent runs an approved action against a new target, that target appears under Suggested; select Add to promote it into the trusted list.

Browser actions​

After a browser action runs, Cracken also checks where it actually went: the page it ended on, any redirects on the way, and requests to hosts the action itself names. What a trusted page loads or calls on its own, such as stylesheets, fonts, images, scripts, and analytics, doesn't count as a target. Protected targets count every time.

In Semi, if a browser action reached a host outside Trusted Targets or a protected target, the operation pauses and the console lists the hosts. Add out-of-scope hosts to Trusted Targets if they belong to the assessment, then select Resume; the agent is told which hosts were out of scope. In guarded Auto, the operation continues and you get an out-of-scope browser notification.

Infrastructure Allowlist​

The Infrastructure Allowlist is separate from Trusted Targets. It holds IPs and CIDRs for tool infrastructure — DNS resolvers, Docker networks, and similar — that the agent connects to as part of running a tool rather than as an assessment target. These entries are filtered out before scope checking, so they never count as in-scope targets. The allowlist does not change protected-target handling.

Protected targets​

Some designated targets require approval in Semi, regardless of the selected trust level.

Unleashed runs without policy evaluation. Use it only when unrestricted execution is intentional.

Destructive actions​

The policy may require approval for some destructive actions independently of the selected trust level. Semi queues those actions for approval; per-action exception rules do not override those requirements.

Exception Rules​

Exception rules let specific actions auto-execute regardless of the trust level. They are created when you approve an action: approving an action can save a rule that allows the same action to run automatically in the future.

Each rule shows the tool it applies to, a risk badge derived from its intrusiveness, an enable/disable switch, and a delete button. Disable a rule to suspend it without losing it, or delete it to remove it.

Configure assistance​

When you want Cracken to translate an intent into semi-auto settings, use the Configure playbook. There are two entry points:

  • In the Custom Policy builder, expand Describe what you need, type the intent, and select Configure playbook.
  • Inside an operation, use the @Configure mention and describe the desired behavior in natural language.

For example:

"Allow all nmap scans on 10.0.0.0/8 but require approval for any exploitation attempts. Never run destructive actions against production databases."

Cracken creates a Configure operation from the request and proposes matching settings. Review the operation's proposed changes before applying them.

Configure the policy​

  1. Open Realm Settings and select the Autonomy Policy tab.
  2. In Trust Level, choose a preset, or select Customize to build a custom policy.
  3. In Trusted Targets, add the domains, IPs, ranges, and wildcards actions may target automatically.
  4. Optionally, in Infrastructure Allowlist, add tool-infrastructure IPs and CIDRs to exclude from scope checking.
  5. Exception rules accumulate as you approve actions; review and toggle them in Exception Rules.
  6. Save each card's changes from the buttons that appear after you edit it.

You can also reach these settings from the new-operation composer. With Semi selected, a Set up control appears next to the autonomy picker while the realm has no trusted targets; once targets are configured it becomes a settings icon that summarizes the realm's trusted targets and trust level. Both open Realm Settings → Autonomy Policy in a new tab, so the task you typed stays in the composer. Realm settings can be changed by the realm's creator, or by a workspace Owner or Admin once the realm is published; if you cannot edit the realm, the control tells you to ask someone who can.

To adjust the policy from inside an operation, use the @Configure mention and review the resulting Configure operation.

Per-operation override​

A single operation can run under a different policy than the realm default. The autonomy switcher at the top of the operation — Manual, Semi, or Unleashed — sets the level for that operation. The policy applies to Semi; Manual waits for each action, while Unleashed runs without action checks. The Edit semi-auto override control next to the switcher opens the full policy settings scoped to just that operation, leaving the realm policy unchanged.

Next steps​

  • Operations — where actions are proposed, approved, and auto-executed.
  • Notifications — how pause-and-ask approval requests reach you.
  • Realms — the boundary the policy applies to.
  • Automations — create operations automatically, which then run under this policy.