Tetragon Runtime Policy Checklist from Cluster Notes (No Invented Alert Totals)

Prompt

Act as a Tetragon runtime-policy checklist coordinator who only uses pasted cluster notes. You compile a runtime-policy checklist the notes already support. You do not invent alert totals, deny counts, cluster ranks, or CVE scoreboards. This is not a live Tetragon sync, not Falco rule merge, and not security scoring advice.
You work only from Inputs. Do not invent stats, citations, quotes, URLs, names, IDs, or records that are not in Inputs.

Inputs:
- Cluster notes I lock (policy stubs, match cues, action fragments): [ClusterNotes]
- Tetragon version or cluster notes I lock: [Version]
- Cluster or namespace label I may quote (or UNKNOWN): [ClusterLabel]
- Policy labels already present (or UNKNOWN): [PolicyLabels]
- Match process cues already present (or UNKNOWN): [MatchProcessCues]
- Action or enforce cues already present (or UNKNOWN): [ActionCues]
- Severity or review cues already present (or UNKNOWN): [SeverityCues]
- Words I must not use: [Banned]
- What I must never invent (alert totals, deny counts, cluster ranks, CVE scoreboards): [Never]
- Output format: [Format]
- Language: [Lang]

Generate:
1. Honesty ledger: ClusterNotes nouns, Version, ClusterLabel, PolicyLabels, MatchProcessCues, ActionCues, SeverityCues, Lang. Banner: not security scoring advice; not a live Tetragon sync. Forbidden: invented alert totals, deny counts, cluster ranks, CVE scoreboards.
2. Runtime-policy checklist: one checkbox row per PolicyLabels entry. Attach only MatchProcessCues and ActionCues named beside that policy in ClusterNotes. Missing cue write NOT IN INPUTS.
3. Severity sketch: for each SeverityCues entry, list policies that name it. Do not invent a 318 alert-total claim if absent.
4. Enforce caution block: quote ActionCues only. Falco packs not in ClusterNotes stay NOT IN INPUTS.
5. Refuse list: inventing 318 alert totals, inventing 44 deny counts, inventing cluster rank #1, inventing CVE scoreboards.
6. Compliance pass: quote Banned and Never hits. Cut them. Print policy and match counts from ClusterNotes only. Format as Format.

Constraints:
- Runtime-policy checklist from ClusterNotes only. No invented alert totals.
- Honor Version. No emojis. Not a live Tetragon dashboard. Not security scoring advice.

Instructions

Replace every [bracket] with your details before running. Works on ChatGPT, Claude, and Gemini.

Generated Output

This image was generated using the prompt above.

Tetragon Runtime Policy Checklist from Cluster Notes (No Invented Alert Totals) - Result

Examples

Example Input

ClusterNotes: policy label Harbor Block Exec as pasted match /bin/bash as pasted action Audit as pasted; policy label Quay Deny CapSysAdmin as pasted match capability CAP_SYS_ADMIN as pasted. Alert invent NONE. Deny invent NONE.
Version: Tetragon as pasted (do not invent unreleased AI policy coach)
ClusterLabel: Cedar Pier staging as pasted
PolicyLabels: Harbor Block Exec as pasted; Quay Deny CapSysAdmin as pasted. Background Network UNKNOWN.
MatchProcessCues: match /bin/bash as pasted for Harbor Block Exec; match capability CAP_SYS_ADMIN as pasted for Quay Deny CapSysAdmin. kubectl pack UNKNOWN.
ActionCues: action Audit as pasted for Harbor Block Exec; Quay Deny CapSysAdmin action NOT IN INPUTS.
SeverityCues: severity Review as pasted for Harbor Block Exec; Quay Deny CapSysAdmin severity NOT IN INPUTS.
Banned: 318 alerts, 44 denies, guaranteed cluster rank #1
Never: invent alert totals, invent deny counts, invent cluster ranks, invent CVE scoreboards
Format: ledger + runtime-policy checklist + severity sketch + enforce caution + refuse + compliance
Lang: English

Example Output

1. Ledger. ClusterNotes: policy label Harbor Block Exec + match /bin/bash + action Audit; policy label Quay Deny CapSysAdmin + match capability CAP_SYS_ADMIN. Alert invent NONE. Deny invent NONE. Version Tetragon. ClusterLabel Cedar Pier staging. PolicyLabels Harbor Block Exec; Quay Deny CapSysAdmin. MatchProcessCues /bin/bash for Harbor Block Exec; capability CAP_SYS_ADMIN for Quay Deny CapSysAdmin. ActionCues Audit for Harbor Block Exec; Quay Deny CapSysAdmin action NOT IN INPUTS. SeverityCues Review for Harbor Block Exec; Quay Deny CapSysAdmin severity NOT IN INPUTS. Lang English. Banner: not security scoring advice; not a live Tetragon sync. Forbidden: invented alert totals, deny counts, cluster ranks, CVE scoreboards, 318 alerts, 44 denies, guaranteed cluster rank #1.

2. Runtime-policy checklist.
[ ] Harbor Block Exec | match /bin/bash | action Audit as pasted.
[ ] Quay Deny CapSysAdmin | match capability CAP_SYS_ADMIN | action NOT IN INPUTS.
Background Network not attached. kubectl pack not added.

3. Severity sketch.
severity Review | policy Harbor Block Exec as pasted.
Quay Deny CapSysAdmin severity | NOT IN INPUTS.
Alert totals NOT IN INPUTS so do not invent 318 alerts. Second Review cue not invented.

4. Enforce caution. action Audit as pasted for Harbor Block Exec. Quay Deny CapSysAdmin action NOT IN INPUTS. Falco pack NOT IN INPUTS. Do not invent CVE packs.

5. Refuse. 318 alert totals: refused. 44 deny counts: refused. cluster rank #1: refused. CVE scoreboards: refused. Unreleased AI policy coach: refused.

6. Compliance. Banned hits none. Policies 2. Matches named 2. Format ledger+runtime-policy checklist+severity sketch+enforce caution+refuse+compliance. Gaps: Quay Deny CapSysAdmin action, Quay Deny CapSysAdmin severity, Background Network, kubectl pack, alert totals.

Missing-data policy: if a field was blank, write NOT IN INPUTS rather than guessing. Lock any tool version named in Inputs; if unnamed, write unknown. No invented testimonials, star ratings, or press logos. If legal, clinical, insurance, HR, education-plan, or veterinary content appears, add a one-line not-advice and de-identify banner. Quote banned-word hits and cut them. End with a gaps list of five bullets the user still owes you. Character and byte caps in the job are hard; print counts when relevant. Refuse to backfill DOIs, exam dumps, PHI, PII, or compensation promises not in Inputs.