Policies

Platform

Text size

Policies

Policies constrain agents and tools: what they may call, what needs approval, and what is blocked. Policies are written in Rego and evaluated against tool-call inputs.

Open Workspace Settings → Governance → Policies.

Available for roles: Admin Workspace Admin

Scope: Workspace

Catalog

1. Click Create Policy to open the policy editor modal.
2. Search and filter existing policies.
3. Assign policies to agents from the agent detail page.

Create a policy

1. Click Create Policy.
2. Optionally use Assist me to draft name, description, type, and Rego from a plain-English request.
3. Open Details and fill:

Field	Required	Example
Policy name	Yes	docs-capture-deny-shell (kebab-case)
Description	No	Deny run_shell; allow read-only investigation tools.
Type	Yes	logic (also temporal or intervention)

4. Edit Policy rego source. Package must be policy. Example deny-shell starter:

package policy

default allow = false

allow if {
  input.tool.name != "run_shell"
}

Or pick a baseline template such as Allow all, Deny by default allow listed tools, or Human approval (HITL).

5. Optionally open Test your policy and dry-run against sample inputs:

Scenario	Example tool input
Should allow	tool.name = "math", arguments { "a": 2, "b": 3 }
Should deny	tool.name = "run_shell", arguments { "command": "ls -la" }

6. Click save/create to publish the policy, or cancel to discard.
7. Open the target agent and attach this policy.

Use policies with Approvals when type is intervention so gated actions wait for a human.