Policies

The policy model

A policy is a named, versioned, declarative rule (see policy-as-code) that evaluates inputs, outputs, or tool calls. Policies are stored as code, reviewed in pull requests, and tested in CI.

Syntax

policy "<name>" {
  applies_to = <selector>
  when <predicate>
  <action>
  audit = always | violations | never
}

Actions include deny, allow, redact, escalate, and require_review.

Scoping & inheritance

Policies inherit from workspace to environment to application. A workspace-level deny cannot be overridden downstream. An application-level allow can only narrow, never widen.

Versioning

Every policy is content-addressed. Audit records pin the exact policy version that produced a decision.