May this command line run?

uv

$ uvx ljos-policyd check -- uv run pytest
allow
$ uvx ljos-policyd check -- sudo id
deny	sudo

First matching deny wins. Exit 2. exec runs the line only on allow.

Janet

(defn check [argv]
  (when (has-prefix? (get argv 0) "sudo")
    (deny "sudo")))

A Janet pack denies more after this binary. It cannot allow what the binary denied. The seat composes it: ljos policy -- uv run pytest.

The hook

ljos hook reads the action about to happen. The binary is the gate. The pack rule is memory beside it.