# Write and review durable rules

Save a durable rule as a reviewed Markdown document, then confirm the exact saved version. Draft autosave, Commit version and repository sync are separate steps; none starts a loop or grants runtime authority.

## Before editing

Open [Policy Hub Documents](https://dashboard.ouros.md/policy) in the intended workspace. Read the selected document path and storage status. If the status is **Session only** or persistent storage is unavailable, download the text before leaving; do not treat a session draft as a durable commit.

Preserve an existing draft before choosing another document. **Compose**, **Read** and **Markdown** are views of the same document, not separate copies.

## Make one rule actionable

1. Select the intended document with the **Document** control.
2. Use **Markdown** for the full source or **Compose** for line editing. State the permitted files or sources, allowed work, prohibited actions, approval points and completion evidence.
3. Replace conflicting older wording in the same document. Do not append an exception that leaves the default ambiguous.
4. Use **Read** to check meaning and wrapping. A rule must remain understandable without the conversation that produced it.

### Separate instructions from enforcement

A useful instruction names a concrete boundary: which project to inspect, which check establishes completion and when to stop for approval. It must not describe an unavailable tool as enabled. Capability review checks the editor's supported local contract; it is not an arbitrary policy-language interpreter.

The supplied `AGENTS.md` contract keeps a local execution target, explicit source selection and denied actions. Do not remove a denied capability or enable gateway fallback merely to silence validation. Change real access only through its owning control and authorization.

## Review the exact version

1. Choose **Review & save**.
2. Inspect each added, modified or deleted block, including unchanged surrounding rules when their meaning depends on the change.
3. Expand **Boundary validation**. Resolve unexplained issues before distributing the document.
4. Check the displayed SHA-256 digest, then choose **Commit version** when device storage is available.
5. Confirm the saved-version notice. Open **History and document tools**, then **Version history**, and read the saved text.

Editing again closes the old review. Review the new content instead of assuming the previous digest covers it. A saved signature checks content integrity; it is not proof that an agent applied the rule.

## Sync only when needed

Under **History and document tools**, open **Workspace repository**. Sync requires a verified device version matching the current document; `AGENTS.md` must also pass capability review. Repository sync checks the returned document against that saved version.

If sync is unavailable or a conflict is reported, keep the device version and download the draft. Do not overwrite a newer repository file or copy credentials between sessions. See [document recovery](/docs/shared/recover-policy-documents).

## Check the consumer

In a new task, verify that the intended agent reads the correct document and applies its scope. A rule saved in Policy Hub is not automatically a file in every local project, a model memory update or an operating-system permission. Use [Runtime permissions](/docs/shared/runtime-permissions) to inspect enforced function access separately.