# Variable SecurityConfigSchema`Const`

SecurityConfigSchema: ZodObject<
{
allowedPaths: ZodDefault<ZodArray<ZodString>>;
blockedPatterns: ZodDefault<ZodArray<ZodString>>;
rateLimit: ZodDefault<
ZodObject<
{
enabled: ZodDefault<ZodBoolean>;
requestsPerMinute: ZodDefault<ZodNumber>;
perTool: ZodOptional<
ZodRecord<
ZodString,
ZodObject<
{
capacity: ZodDefault<ZodNumber>;
refillRate: ZodDefault<ZodNumber>;
refillIntervalMs: ZodDefault<ZodNumber>;
},
$strip,
>,
>,
>;
},
$strip,
>,
>;
secretsFile: ZodOptional<ZodString>;
policy: ZodOptional<
ZodObject<
{
defaultMode: ZodDefault<
ZodEnum<{ "read-only": "read-only"; "read-write": "read-write" }>,
>;
policyMode: ZodDefault<ZodEnum<{ warn: "warn"; enforce: "enforce" }>>;
},
$strip,
>,
>;
sandbox: ZodOptional<
ZodObject<
{
mode: ZodDefault<
ZodEnum<{ policy: "policy"; none: "none"; container: "container" }>,
>;
fallbackToPolicy: ZodDefault<ZodBoolean>;
dockerImage: ZodOptional<ZodString>;
networkEnabled: ZodDefault<ZodBoolean>;
},
$strip,
>,
>;
timeout: ZodOptional<
ZodObject<
{
defaultTimeoutMs: ZodDefault<ZodNumber>;
maxTimeoutMs: ZodDefault<ZodNumber>;
enableLogging: ZodDefault<ZodBoolean>;
uriValidation: ZodDefault<ZodBoolean>;
perToolTimeout: ZodOptional<ZodRecord<ZodString, ZodNumber>>;
},
$strip,
>,
>;
toolAllowlist: ZodOptional<ZodArray<ZodString>>;
audit: ZodOptional<
ZodObject<
{
enabled: ZodDefault<ZodBoolean>;
logDir: ZodOptional<ZodString>;
minSeverity: ZodDefault<
ZodEnum<{ info: "info"; warning: "warning"; critical: "critical" }>,
>;
enableHashChain: ZodDefault<ZodBoolean>;
maxFileSizeBytes: ZodDefault<ZodNumber>;
maxFiles: ZodDefault<ZodNumber>;
},
$strip,
>,
>;
auth: ZodOptional<
ZodObject<
{
enabled: ZodDefault<ZodBoolean>;
method: ZodDefault<ZodEnum<{ token: "token"; oauth2: "oauth2" }>>;
tokenHeader: ZodDefault<ZodString>;
tokenFile: ZodOptional<ZodString>;
},
$strip,
>,
>;
},
$strip,
> = ...

Security configuration schema.

- Defined in packages/nexus-agents/src/config/schemas-security.ts:110