Skip to Content

AIX CLI Configuration & Governance

This guide covers complete configuration options, environment variables, security boundaries, and Cedar policy contracts enforced by the AIX CLI.

1. Environment Variables Reference

Environment VariableTypeDefaultDescription
AIX_PROFILEstringsnActive target profile name
AIX_BASE_URLurlhttps://aix.snnc.ccEnterprise gateway and model pool base endpoint
AIX_API_KEYsecretNoneHeadless service account or developer API token
AIX_MODEenumcontrolDefault autonomy mode (control, auto, fast, plan)
AIX_AUTO_APPROVEbooleanfalseWhen true, automatically approves bounded workspace modifications
AIX_CIRCUIT_BREAKER_MAXinteger3Maximum repetitive tool failures before tripping breaker
AIX_MAX_TOOL_CALLSinteger50Maximum number of tool iterations in an autonomous SWE loop
AIX_TIMEOUTinteger600Task execution timeout ceiling in seconds
AIX_SANDBOX_DIRpathCurrent Git rootBounded root directory for file read/write operations
AIX_LOG_LEVELenumINFOLogging verbosity (DEBUG, INFO, WARNING, ERROR)
AIX_TELEMETRY_ENABLEDbooleantrueExport anonymized OpenTelemetry metrics and traces

2. Configuration File (~/.aix/config.yaml)

Configuration is stored at user level and can be version-controlled:

version: "1.0"
active_profile: "sn"
 
profiles:
  sn:
    base_url: "https://aix.snnc.cc"
    model_pool: "sn-enterprise"
    default_model: "claude-3-5-sonnet"
    auth:
      provider: "authentik_pam"
      tenant_id: "sweetnight"
    circuit_breaker:
      max_consecutive_errors: 3
      repetitive_call_threshold: 2
    sandbox:
      strict_git_boundary: true
      denied_patterns:
        - "**/.env*"
        - "**/*.pem"
        - "**/*.key"
 
  gcp:
    base_url: "https://aix.snnc.cc/saas"
    model_pool: "agy-gcp"
    default_model: "gpt-4o"

3. Cedar Policy Governance & PAM Leases

Every tool invocation executed by aix CLI is intercepted by the local permission broker and validated against enterprise Cedar policies:

// Sample Cedar policy enforced by AIX CLI runtime
permit(
    principal in Role::"SeniorDeveloper",
    action in [Action::"ReadFile", Action::"EditFile", Action::"RunPytest"],
    resource in Resource::"Workspace"
);

forbid(
    principal,
    action == Action::"RunShellCommand",
    resource
) when {
    resource.command like "*rm -rf*" || resource.command like "*drop database*"
};

Privileged Access Management (PAM) Leases

When elevated actions are required (e.g. running production database migrations or deploying containers):

# Request temporary 2-hour elevated PAM lease
aix auth lease request --scope "prod:cluster:read" --duration 2h --reason "Investigate latency spike #891"
 
# Check active lease status
aix auth lease status