Policy Resources

Shared policy attributes

Each policy resource requires exactly one match representation. module uses Policy-as-code. conditions uses the complete native condition language as native HCL objects, tuples, and values. No JSON encoding or escaping is needed. Shared attributes are:

Attribute	Requirement and type	Exact meaning
`id`	Required string, 1–256 characters; forces replacement	Immutable, user-chosen policy identity. Must begin alphanumeric and may then contain letters, digits, `.`, `_`, `:`, `@`, `/`, or `-`.
`name`	Required non-empty string	Mutable display name; not used for Terraform identity or references.
`description`	Optional non-empty string	Human explanation stored with the revision.
`rationale`	Optional non-empty string	Why the policy exists. It is revisioned metadata and does not change matching by itself.
`use_cases`	Optional set(string), max 9	Product use-case tags: `Data Encryption`, `Public Exposure`, `Data Sprawl`, `Organizational Access`, `Resilience`, `Runtime Safety`, `Credential Risk`, `AI Model Governance`, or `Shadow AI`.
`compliance_frameworks`	Optional set(string), max 8	Framework tags: `Security Basics`, `NIST`, `CIS`, `GDPR`, `HIPAA`, `PCI DSS`, `SOC 2`, or `OWASP`.
`labels`	Optional set(string), max 256	Free-form non-empty revision labels for ownership, environment, and search. Labels do not affect matching.
`enabled`	Optional boolean; default `true`	Whether the revision participates in new evaluations. Disabling preserves history and identity.
`users`	Optional set(string), max 256	Exact user emails resolved at apply. Empty/omitted means this scope dimension does not restrict the policy.
`groups`	Optional set(string), max 256	Exact group names resolved at apply.
`user_directory_ids`	Optional map(string), max 256	Maps a configured user email to a directory ID only when duplicate exact email matches need disambiguation. Every key must also be in `users`.
`group_directory_ids`	Optional map(string), max 256	Maps a configured group name to a directory ID only when duplicate exact name matches need disambiguation. Every key must also be in `groups`.
`module`	Optional string, 1 byte–256 KiB	Exact `forge.rego.v1` source for the family package; mutually exclusive with `conditions`.
`conditions`	Optional native HCL object	Complete recursive native condition tree; mutually exclusive with `module`. Terraform retains its structure in plans and state.
`except`	Optional native HCL object	Complete recursive condition tree using the same family fields. A match suppresses this policy after its primary condition or Rego match succeeds.
`exceptions`	Optional native HCL collection	Named exceptions with an ID, reason, optional expiration, and condition tree. Each suppresses only this policy.
`action`	Required enum	Typed consequence applied when the selected match representation succeeds; family values are below.
`message`	Optional non-empty string	Content consequence guidance or Resource block guidance.
`auto_approve_on_request`	Optional boolean	Valid only with `require_approval`. `true` still creates a request before issuing its revision-bound scoped grant. Omitted is false.
`current_revision`	Computed integer	Latest immutable server revision observed by Terraform and used for optimistic updates/deletes.
`definition_sha256`	Computed SHA-256	Digest of the complete server policy definition.
`module_sha256`	Computed SHA-256 or null	Digest of exact Rego source; null for native conditions.
`validation_token`	Computed sensitive string	Short-lived signed binding for the reviewed plan. Provider-managed and retained as sensitive state solely for Terraform plan/apply consistency.

Native condition language

Every condition is one HCL object. A predicate compares one typed field:

conditions = {
  field = "request.prompt"
  op    = "contains"
  value = "confidential"
}

Use all when every child must match, any when at least one must match, and not to invert one child. all and any each accept 1–64 condition objects. Trees may contain at most 512 nodes and 16 levels.

conditions = {
  all = [
    { field = "device.platform", op = "eq", value = "darwin" },
    {
      not = {
        field = "device.id"
        op    = "in"
        value = ["break-glass-device"]
      }
    }
  ]
}

Predicate properties are exact; extra properties are rejected:

Property	Requirement	Meaning
`field`	Required string	A field from the family catalog below.
`op`	Required enum	One operator from the table below.
`value`	Required except for `exists`; forbidden for `exists`	A type-preserving HCL scalar, tuple, object, or collection. The operator and field determine valid runtime types.

Operator	Exact test
`eq` / `neq`	Field is equal / not equal to `value`. Objects and collections compare structurally.
`in` / `not_in`	Field is / is not a member of the collection in `value`.
`contains`	String contains a substring, or collection contains one value.
`contains_any`	Collection contains at least one member supplied by `value`.
`contains_all`	Collection contains every member supplied by `value`.
`starts_with` / `ends_with`	String starts / ends with the supplied string.
`matches`	String matches the RE2 regular expression in `value`; patterns are limited to 1,024 bytes and validated before apply.
`gt` / `gte` / `lt` / `lte`	Ordered field is greater than / at least / less than / at most `value`.
`exists`	Field is present and non-null. Omit `value`.

Field catalog

Terraform accepts the same native-condition fields as the policy engine. The catalog is grouped by namespace so plans remain readable:

Family	Namespace	What it contains
Content	`identity.*`	Human, group, and service-account bindings used during evaluation.
Content	`request.`, `response.`	Prompt input and model output available when the selected stage is supported.
Content	`event.*`	Source event kind, title, summary, labels, and severity.
Content	`tool.*`	Tool identity, sanitized inputs, paths, commands, destinations, environment names, and results.
Content	`classification.*`	Sensitivity, data, category, provenance, proof, and unresolved-content signals.
Content	`mcp.`, `llm.`	MCP package/server/tool facts and model/provider/token facts.
Access	`identity.`, `device.`, `product.*`	Subject, endpoint, and application bindings.
Access	`destination.`, `process.`	Network destination and local-process facts.
Access	`browser.*`	Extension and browser-account facts.
Resource	`identity.`, `device.`, `process.`, `destination.`, `resource.*`	Authenticated caller, device, proven process, destination, selected Resource, and protocol.
Resource	`request.http.*`	HTTP method, path without query parameters, and normalized content type.
Resource	`request.postgres.*`	PostgreSQL database, requested user, command, completely identified schemas/tables, and literal-free query pattern.
Resource	`request.mysql.*`	MySQL database, destination user, command, completely identified tables, and literal-free query pattern.
Resource	`request.redis.*`	Redis logical database, destination ACL user, and uppercase top-level command.

See Conditions for every accepted field, its exact type, meaning, availability, and family. A field from another policy family is rejected. Content and Resource Policies additionally support history-aware operators:

Operator	Required object properties	Exact meaning
`hasPriorEvent`	One nested condition object	Matches when any earlier event in the evaluation history matches the child.
`hasEventSequence`	`within`, `ordered`, `events`	Matches a 2–16 item event sequence inside the duration. `ordered = true` requires listed order; `false` permits any order.
`eventCount`	`within`, `where`, `op`, `value`	Counts prior events matching `where` and compares that count.
`priorDistinctValues`	`within`, `field`, `op`, `value`; optional `where`	Counts distinct non-null values of a family-valid field among prior events, optionally filtered by `where`, then compares the count.

within must be a positive integer followed by s, m, h, or d, such as 30s, 15m, 12h, or 7d, and cannot exceed 30 days. Count op is eq, gt, gte, lt, or lte; count value is an integer from 0 through 1,024. Content evaluates these predicates over the bounded current agent-session history. Resource evaluates them over bounded, policy-safe facts ordered within the same authenticated Resource connection. Resource backtests group retained facts by connection ID. These forms do not currently express a rate limit across Resource connections, users, devices, or the organization.

conditions = {
  eventCount = {
    within = "15m"
    where  = { field = "tool.id", op = "eq", value = "customer.export" }
    op     = "gte"
    value  = 3
  }
}

The provider validates structure, family fields, enums, limits, durations, and regular expressions locally. Forge then applies the complete policy contract and runtime type rules authoritatively during the resource write. This second check prevents an older provider from weakening or reinterpreting a newer server contract.

`forge_content_policy`

Attribute	Requirement and type	Exact meaning
`service_accounts`	Optional set(string), max 256	Exact service-account names resolved into Content scope.
`agents`	Optional set(string), max 256	Exact agent names/labels resolved into Content scope.
`products`	Optional set(string), max 256	Exact product names/slugs resolved into Content scope.
`evaluate_on`	Required ordered list, 1–4 unique values	Control points at which to evaluate: `prompt` before submission; `pre_tool` before execution; `post_tool` after execution and before reuse; `response` on model output.
`action`	Required enum	`allow`, `nudge`, `flag_for_review`, `redact`, `filter`, `require_approval`, or `block`, with behavior defined in Actions.
`redaction_strategy`	Required for `action = "redact"`; defaults to `constant` if omitted by provider compatibility logic	`constant`, `partial`, `hash`, `nullify`, or `fake`. No redaction attribute is valid for another action.
`redaction_replacement`	Required string for `constant`	Exact replacement string; empty is allowed.
`redaction_paths`	Optional set(string), 1–64 when present	Unique bounded paths. Omit to transform the whole control-point value.
`redaction_keep_start`	Optional integer 0–256	Prefix characters retained by `partial`; at least one keep attribute is required.
`redaction_keep_end`	Optional integer 0–256	Suffix characters retained by `partial`; at least one keep attribute is required.
`redaction_mask_character`	Optional one-character string	Mask used by `partial`; defaults to `*`.
`redaction_salt_ref`	Optional identifier	Domain-separation label used by `hash`; it is not secret material.
`redaction_fake_subtype`	Required for `fake`	`string`, `email`, `phone`, `ipv4`, or `payment_card`.
`filter_collection_path`	Required for `action = "filter"`	Bounded path to the post-tool array being filtered.
`filter_path`	Required for `filter`	Bounded path evaluated from each collection element.
`filter_operator`	Required for `filter`	`eq`, `neq`, `contains`, `starts_with`, `ends_with`, `gt`, `gte`, `lt`, or `lte`.
`filter_value`	Required dynamic value for `filter`	Type-preserving HCL value compared by the predicate. It may be a scalar, collection, or object, although the selected operator must support the runtime type.
`filter_on_unavailable`	Required for `filter`	`allow` leaves the original result unchanged; `block` blocks when the configured paths cannot be evaluated.

The response checkpoint is endpoint- and capability-dependent. The LLM Gateway does not provide it. Timing constraints still apply: approval is pre_tool only, filtering is post_tool only, and path redaction is pre_tool or post_tool only.

`forge_access_policy`

Attribute	Requirement and type	Exact meaning
`devices`	Optional set(string), max 256	Exact device names resolved into Access scope.
`enforced_by`	Optional set(string), max 256	Exact integration names resolved authoritatively by Forge. Missing or ambiguous names fail the plan/apply rather than falling back to another integration.
`enforcement_surfaces`	Required set(enum), 1–3	Runtime surfaces that can execute the result: `inline_hook`, `endpoint_route`, or `provider`.
`severity`	Optional enum	`low`, `medium`, `high`, or `critical`; defaults to `medium`.
`acknowledge_broad_scope`	Optional boolean	Defaults to `false`. Must be explicitly enabled when Forge identifies an enabled disruptive policy with broad scope.
`action`	Required enum	`allow`, `flag_for_review`, `require_approval`, or `block`.
`approval_mode`	Optional enum	`admin_approval` or `self_serve`; defaults to `admin_approval`. Valid only where approval applies.
`runtime`	Optional native HCL object	Runtime selection and failure behavior: `candidateMode`, `detectionMode`, `detectionLatencyMs`, `timeoutBehavior`, `failBehavior`, and `confidenceThreshold`.
`notification`	Optional native HCL object	Structured Access notification contract. Its fields and acknowledgement rules are defined in Schema.
`remediation`	Optional native HCL object	Structured remediation contract containing `triggerPhase`, `applyWhenClassification`, and one or more actions with their typed parameters.

Access, Content, and Resource expose only their own family attributes. Terraform rejects cross-family fields instead of silently discarding or retaining them as null state.

`forge_resource`

The generated forge_resource reference is the source of truth for its schema, validation, import format, and examples. forge_resource manages one HTTP, HTTPS, PostgreSQL, MySQL, or Redis destination separately from its policies and credentials:

resource "forge_resource" "production_database" {
  name                = "Production PostgreSQL"
  protocol            = "postgres"
  upstream_host       = "db.internal.example"
  upstream_port       = 5432
  upstream_tls        = true
  gateway_id          = forge_resource_gateway.production.id
  transparent_routing = true
}

protocol is http, postgres, mysql, or redis. upstream_tls defaults to true; PostgreSQL, MySQL, and Redis require it. For a destination using a private certificate authority, set upstream_ca_pem = trimspace(file("private-ca.pem")). There is no insecure certificate-verification setting. transparent_routing defaults to false; turning it on publishes the Resource to managed endpoint routes. A gateway_id is required for direct access and automatic routing.

`forge_resource_credential`

The generated forge_resource_credential reference is the source of truth for supported credential kinds, assignments, rotation, import format, and examples. Credentials have a separate lifecycle so rotation and identity assignments do not rewrite the Resource or its policies. Terraform 1.11 or newer is required because secret is sensitive and write-only. Supply it through an ephemeral variable:

variable "database_password" {
  type      = string
  sensitive = true
  ephemeral = true
}

resource "forge_resource_credential" "production_database" {
  resource_id    = forge_resource.production_database.id
  name           = "Application account"
  kind           = "username_password"
  username       = "forge_app"
  secret         = var.database_password
  secret_version = 1
  default        = true
}

Credential kind is username_password, bearer_token, header, aws_rds_iam, oauth2_client_credentials, or oauth2_token_exchange, subject to Resource protocol validation. The generated reference lists the required and incompatible fields for each kind. Assignments use users, groups, and service_accounts; default applies only when no identity-specific assignment exists. With no matching or default credential, Forge rejects the connection instead of passing through caller credentials. Increment secret_version and provide a replacement secret in the same change to rotate it. Plan, state, refresh, API responses, and imports never recover the secret. Import a credential with <resource-id>/<credential-id>.

`forge_resource_policy`

The generated forge_resource_policy reference is the source of truth for its schema, validation, import format, and examples. forge_resource_policy is a peer of forge_access_policy and forge_content_policy over the shared policy engine. It uses the same native condition tree and operators, named exceptions, outcomes and precedence, messages, immutable revisions, forge.rego.v1, backtests, validation tokens, and Terraform authority. Its distinct Resource scope, enforcement mode, protocol field catalog, and actions are checked against the selected Resources.

Attribute	Requirement and type	Exact meaning
`service_accounts`	Optional set(string), max 256	Authenticated service-account IDs governed by the policy.
`devices`	Optional set(string), max 256	Device IDs governed by the policy.
`resources`	Optional set(string), max 256	Stable Forge Resource IDs governed by the policy.
`enforcement`	Optional `enforce` or `monitor`; default `enforce`	`enforce` applies the outcome. `monitor` records what would happen while allowing Resource traffic to continue.
`severity`	Optional enum; default `medium`	`low`, `medium`, `high`, or `critical`.
`acknowledge_broad_scope`	Optional boolean; default `false`	Required for an enabled, broad, disruptive Resource Policy.
`action`	Required enum	`allow`, `flag_for_review`, `block`, `redact`, `filter`, or `require_approval`.
`data_target`	Required for `redact` or `filter`	`http_request_body`, `http_response_body`, `postgres_result`, or `mysql_result`.
`approval_mode`	Required for `require_approval`	`admin_approval` or `self_serve`.
`message`	Optional non-empty string	Customer guidance returned with a block, approval, or fail-closed transformation.
Redaction attributes	Required for `redact`	Shared `redaction_*` attributes documented for Content policies; PostgreSQL and MySQL require `redaction_paths`.
Filter attributes	Required for `filter`	Shared `filter_*` attributes; PostgreSQL and MySQL require `filter_collection_path = "$.rows"`.

Resource Policies have no evaluate_on or enforcement_surfaces attribute. The referenced Resource fields determine whether the rule runs before connection, on each HTTP request, or before each database or Redis command. Forge validates native and Rego field compatibility against every Resource listed in resources. HTTP request bodies support redaction. HTTP response bodies and PostgreSQL or MySQL results support redaction and filtering. Resource transformations use the same typed strategy, path, predicate, and unavailable-data attributes documented for Content policies, with data_target replacing Content checkpoints. Approval uses approval_mode; Resource policies do not use auto_approve_on_request.

Content Rego example

resource "forge_content_policy" "customer_export" {
  id          = "customer-export"
  name        = "Protect customer exports"
  groups      = ["Finance"]
  evaluate_on = ["pre_tool"]
  action      = "block"

  module = <<-REGO
    package forge.content
    match := {
      "matched": input.tool.id == "customer.export",
      "reasonCode": "customer_export",
    }
  REGO
}

The complete action, evaluation-point, and action-specific attribute semantics are defined in forge_content_policy. Invalid cross-field combinations fail planning or server validation.

Access destination block example

Use destination.domain for simple endpoint-route network policy. It is the right field for blocking a hostname or AI API domain. Do not use process.id for local network route enforcement; use process.name only as a narrowing condition with a route anchor such as destination.domain, destination.ip, or exact destination.port.

resource "forge_access_policy" "unapproved_ai_api" {
  id                      = "unapproved-ai-api"
  name                    = "Block unapproved AI API destination"
  description             = "Block direct endpoint access to an unapproved AI API."
  action                  = "block"
  severity                = "high"
  acknowledge_broad_scope = true
  enforcement_surfaces    = ["endpoint_route"]

  conditions = {
    field = "destination.domain"
    op    = "eq"
    value = "api.deepseek.com"
  }
}

After apply, the Forge Console policy view should show Terraform authority, Block, Endpoint route, and Destination domain equals api.deepseek.com. Run a final connected terraform plan -detailed-exitcode; no changes confirms Terraform state and the Forge policy revision match.

Resource command block example

This Resource Policy blocks DELETE commands for one PostgreSQL Resource and returns useful guidance to the client. It monitors first so the initial rollout does not interrupt traffic; change enforcement to enforce after reviewing Resource Activity and a backtest.

resource "forge_resource_policy" "production_database_writes" {
  id          = "production-database-writes"
  name        = "Protect production database writes"
  resources   = [forge_resource.production_database.id]
  enforcement = "monitor"
  action      = "block"
  severity    = "high"
  message     = "Use the approved change workflow for production writes."

  conditions = {
    field = "request.postgres.command"
    op    = "eq"
    value = "DELETE"
  }
}

For policy as code, use the fixed Resource package:

resource "forge_resource_policy" "production_database_writes" {
  id        = "production-database-writes"
  name      = "Protect production database writes"
  resources = [forge_resource.production_database.id]
  action    = "block"

  module = <<-REGO
    package forge.resource

    match := {
      "matched": input.request.postgres.command == "DELETE",
      "reasonCode": "production_delete",
    }
  REGO
}

Rego-backed transformations keep the action configuration in typed Terraform attributes. The module decides only whether the policy matches:

resource "forge_resource_policy" "customer_api_rego_redaction" {
  id                    = "customer-api-rego-redaction"
  name                  = "Remove customer data from API writes"
  resources             = [forge_resource.customer_api.id]
  action                = "redact"
  data_target           = "http_request_body"
  redaction_strategy    = "constant"
  redaction_replacement = "[REDACTED]"
  redaction_paths       = ["$.customer.email"]

  module = <<-REGO
    package forge.resource

    match := {
      "matched": input.request.http.method == "POST",
      "reasonCode": "customer_api_write",
    }
  REGO
}

Resource data and approval examples

Redact selected JSON fields before an HTTP request is forwarded:

resource "forge_resource_policy" "customer_api_redaction" {
  id          = "customer-api-redaction"
  name        = "Remove customer data from API writes"
  resources   = [forge_resource.customer_api.id]
  action      = "redact"
  data_target = "http_request_body"

  conditions = {
    field = "request.http.method"
    op    = "eq"
    value = "POST"
  }

  redaction_strategy    = "constant"
  redaction_replacement = "[REDACTED]"
  redaction_paths       = ["$.customer.email", "$.customer.phone"]
}

Filter PostgreSQL rows before they reach the client:

resource "forge_resource_policy" "restricted_rows" {
  id          = "restricted-rows"
  name        = "Remove restricted database rows"
  resources   = [forge_resource.production_database.id]
  action      = "filter"
  data_target = "postgres_result"

  conditions = {
    field = "request.postgres.tables"
    op    = "contains"
    value = "customer_records"
  }

  filter_collection_path = "$.rows"
  filter_path            = "$.classification"
  filter_operator        = "eq"
  filter_value           = "restricted"
  filter_on_unavailable  = "block"
}

Require one exact retry after administrator approval:

resource "forge_resource_policy" "production_delete_approval" {
  id            = "production-delete-approval"
  name          = "Approve production deletes"
  resources     = [forge_resource.production_database.id]
  action        = "require_approval"
  approval_mode = "admin_approval"
  message       = "A database owner must approve this production change."

  conditions = {
    field = "request.postgres.command"
    op    = "eq"
    value = "DELETE"
  }
}

The approval grant expires after ten minutes, can be consumed once, and matches only an identical operation by the same caller against the same policy revisions.

Readable references

Use exact user email and exact group, product, agent, route, MCP server/tool, or skill name/slug. Forge resolves names authoritatively. Missing and ambiguous matches fail apply rather than choosing arbitrarily. Forge retains the resolved bindings while refresh preserves readable configuration. Every policy resource with user or group subjects can disambiguate duplicate directory labels without putting a Forge object ID in configuration:

users = ["alex@example.com"]
user_directory_ids = {
  "alex@example.com" = "directory-primary"
}

group_directory_ids works the same way for configured group names. Every map key must also appear in its matching users or groups set; empty qualifiers and unsupported names fail before mutation. Most organizations should omit these maps and use the concise unique email/name form. The same fields are available on MCP ACLs and skill ACLs. Policy id is different: it is a user-chosen durable key, immutable after creation and never reusable after deletion. Choose a stable, descriptive slug.

Import

Policy resources import by their durable policy ID:

terraform import forge_content_policy.customer_export customer-export
terraform import forge_access_policy.unmanaged_ai unmanaged-ai
terraform import forge_resource_policy.production_database_writes production-database-writes

Import reads the remote definition but does not claim authority. For a Forge-managed policy, first apply a matching forge_policy_authority resource at the exact reviewed revision, then import the policy into the same Terraform manager. After import, run a connected terraform plan and reproduce the complete remote scope, condition or module, action, and action-specific configuration in HCL. Omitted attributes are desired changes, not instructions to preserve unknown remote configuration.

Move existing Resource policy state

Resource rules previously declared as forge_access_policy must move to the dedicated Terraform resource. Update the HCL to forge_resource_policy, remove Access-only attributes such as enforcement_surfaces, and move state before planning:

terraform state mv \
  forge_access_policy.production_database_writes \
  forge_resource_policy.production_database_writes
terraform plan

The server migration preserves the policy ID, revision history, exceptions, evaluations, and authority. The state move changes only the Terraform address; it must not create a second policy.

Guides

REST API

Policy Resources

Shared policy attributes

Native condition language

Field catalog

`forge_content_policy`

`forge_access_policy`

`forge_resource`

`forge_resource_credential`

`forge_resource_policy`

Content Rego example

Access destination block example

Resource command block example

Resource data and approval examples

Readable references

Import

Move existing Resource policy state

​Shared policy attributes

​Native condition language

​Field catalog

​forge_content_policy

​forge_access_policy

​forge_resource

​forge_resource_credential

​forge_resource_policy

​Content Rego example

​Access destination block example

​Resource command block example

​Resource data and approval examples

​Readable references

​Import

​Move existing Resource policy state

Shared policy attributes

Native condition language

Field catalog

`forge_content_policy`

`forge_access_policy`

`forge_resource`

`forge_resource_credential`

`forge_resource_policy`

Content Rego example

Access destination block example

Resource command block example

Resource data and approval examples

Readable references

Import

Move existing Resource policy state