Policy

Policy file

The policy is a YAML file evaluated deterministically on every call. There is no separate policy language like OPA/Rego.

Full example

agent: support-agent-v1

tools:
  - name: "lookup_order"
    allow: true
  - name: "issue_refund"
    allow: true
    constraints:
      amount: { max: 5000 }
    require_approval_when:
      amount: { min: 500 }
  - name: "send_email"
    allow: true
    require_approval: true
    egress_scan: true
  - name: "delete_customer"
    allow: false

defaults:
  unlisted_tools: deny
  fail_closed: true

guard_model:
  enabled: false
  provider: "typesafe"

loop_breaker:
  enabled: true
  max_identical_calls: 3

Top-level fields

Field	Type	Description
`agent`	string	The agent id the policy belongs to.
`tools`	list	Tool rules (below).
`resources`	list	Optional resource (MCP resource) rules: `uri_pattern` (regex or substring), `allow`, `require_approval`.
`defaults`	object	`unlisted_tools`, `fail_closed`, `shadow_mode`.
`mode` / `shadow_mode`	enforce \| shadow \| dry-run	Policy-level shadow.
`loop_breaker`	object	Loop breaker settings.
`guard_model`	object	AI Guard settings.

Tool rule

Field	Description
`name`	Tool name.
`allow`	If `false` the tool is always blocked.
`constraints`	Argument constraints: `min`, `max`, `enum`, `regex`. A violation = BLOCK.
`require_approval`	If `true` every call goes to human approval.
`require_approval_when`	Conditional approval: goes to approval when an argument reaches the threshold (`min`/`max`).
`egress_scan`	Arguments are scanned for secrets/PII unless set to `false` (default: on).
`shadow_mode`	Observe-only mode for this tool alone.
`max_identical` / `max_consecutive`	Loop thresholds specific to this tool.

Defaults

Key	Value	Effect
`unlisted_tools`	`deny`	Unlisted tools are blocked. Recommended.
`fail_closed`	`true`	On an inspector error a risky call is blocked/sent for approval.

CarefulIf the SDK is given no policy at all it uses a permissive default: unlisted tools are allowed, but egress/ingress and the loop breaker are on. In production always use an explicit policy and unlisted_tools: deny.

Validation

The dashboard's policy page validates YAML through POST /api/policy/validate before saving. An invalid policy is not saved.