Policy Resources

Content and Access policy attributes

Both policy resources require exactly one match representation. module uses Policy-as-code. conditions uses the complete native condition language as native HCL objects, tuples, and values. No JSON encoding or escaping is needed. Shared attributes are:

Attribute	Requirement and type	Exact meaning
`id`	Required string, 1–256 characters; forces replacement	Immutable, user-chosen policy identity. Must begin alphanumeric and may then contain letters, digits, `.`, `_`, `:`, `@`, `/`, or `-`.
`name`	Required non-empty string	Mutable display name; not used for Terraform identity or references.
`description`	Optional non-empty string	Human explanation stored with the revision.
`rationale`	Optional non-empty string	Why the policy exists. It is revisioned metadata and does not change matching by itself.
`use_cases`	Optional set(string), max 9	Product use-case tags: `Data Encryption`, `Public Exposure`, `Data Sprawl`, `Organizational Access`, `Resilience`, `Runtime Safety`, `Credential Risk`, `AI Model Governance`, or `Shadow AI`.
`compliance_frameworks`	Optional set(string), max 8	Framework tags: `Security Basics`, `NIST`, `CIS`, `GDPR`, `HIPAA`, `PCI DSS`, `SOC 2`, or `OWASP`.
`labels`	Optional set(string), max 256	Free-form non-empty revision labels for ownership, environment, and search. Labels do not affect matching.
`enabled`	Optional boolean; default `true`	Whether the revision participates in new evaluations. Disabling preserves history and identity.
`users`	Optional set(string), max 256	Exact user emails resolved at apply. Empty/omitted means this scope dimension does not restrict the policy.
`groups`	Optional set(string), max 256	Exact group names resolved at apply.
`user_directory_ids`	Optional map(string), max 256	Maps a configured user email to a directory ID only when duplicate exact email matches need disambiguation. Every key must also be in `users`.
`group_directory_ids`	Optional map(string), max 256	Maps a configured group name to a directory ID only when duplicate exact name matches need disambiguation. Every key must also be in `groups`.
`module`	Optional string, 1 byte–256 KiB	Exact `forge.rego.v1` source for the family package; mutually exclusive with `conditions`.
`conditions`	Optional native HCL object	Complete recursive native condition tree; mutually exclusive with `module`. Terraform retains its structure in plans and state.
`except`	Optional native HCL object	Complete recursive condition tree using the same family fields. A match suppresses this policy after its primary condition or Rego match succeeds.
`action`	Required enum	Typed consequence applied when the selected match representation succeeds; family values are below.
`message`	Optional non-empty string	Content: user-facing consequence guidance. Access: enforcement notification text.
`auto_approve_on_request`	Optional boolean	Valid only with `require_approval`. `true` still creates a request before issuing its revision-bound scoped grant. Omitted is false.
`current_revision`	Computed integer	Latest immutable server revision observed by Terraform and used for optimistic updates/deletes.
`definition_sha256`	Computed SHA-256	Digest of the server-canonical complete policy definition.
`module_sha256`	Computed SHA-256 or null	Digest of exact Rego source; null for native conditions.
`validation_token`	Computed sensitive string	Short-lived signed binding for the reviewed plan. Provider-managed and retained as sensitive state solely for Terraform plan/apply consistency.

Native condition language

Every condition is one HCL object. A predicate compares one canonical field:

conditions = {
  field = "request.prompt"
  op    = "contains"
  value = "confidential"
}

Use all when every child must match, any when at least one must match, and not to invert one child. all and any each accept 1–64 condition objects. Trees may contain at most 512 nodes and 16 levels.

conditions = {
  all = [
    { field = "device.platform", op = "eq", value = "darwin" },
    {
      not = {
        field = "device.id"
        op    = "in"
        value = ["break-glass-device"]
      }
    }
  ]
}

Predicate properties are exact; extra properties are rejected:

Property	Requirement	Meaning
`field`	Required string	A field from the family catalog below.
`op`	Required enum	One operator from the table below.
`value`	Required except for `exists`; forbidden for `exists`	A type-preserving HCL scalar, tuple, object, or collection. The operator and field determine valid runtime types.

Operator	Exact test
`eq` / `neq`	Field is equal / not equal to `value`. Objects and collections compare structurally.
`in` / `not_in`	Field is / is not a member of the collection in `value`.
`contains`	String contains a substring, or collection contains one value.
`contains_any`	Collection contains at least one member supplied by `value`.
`contains_all`	Collection contains every member supplied by `value`.
`starts_with` / `ends_with`	String starts / ends with the supplied string.
`matches`	String matches the RE2 regular expression in `value`; patterns are limited to 1,024 bytes and validated before apply.
`gt` / `gte` / `lt` / `lte`	Ordered field is greater than / at least / less than / at most `value`.
`exists`	Field is present and non-null. Omit `value`.

Field catalog

Terraform accepts the same canonical native-condition fields as the policy engine. The catalog is grouped by namespace so plans remain readable:

Family	Namespace	What it contains
Content	`identity.*`	Human, group, and service-account bindings used during evaluation.
Content	`request.`, `response.`	Prompt input and model output available when the selected stage is supported.
Content	`event.*`	Source event kind, title, summary, labels, and severity.
Content	`tool.*`	Tool identity, sanitized inputs, paths, commands, destinations, environment names, and results.
Content	`classification.*`	Sensitivity, data, category, provenance, proof, and unresolved-content signals.
Content	`mcp.`, `llm.`	MCP package/server/tool facts and model/provider/token facts.
Access	`identity.`, `device.`, `product.*`	Subject, endpoint, and application bindings.
Access	`destination.`, `process.`	Network destination and local-process facts.
Access	`browser.*`	Extension and browser-account facts.

See Conditions for every accepted field, its exact type, meaning, availability, and the separate Access catalog. A field from the other policy family is rejected. Content policies additionally support history-aware operators:

Operator	Required object properties	Exact meaning
`hasPriorEvent`	One nested condition object	Matches when any earlier event in the evaluation history matches the child.
`hasEventSequence`	`within`, `ordered`, `events`	Matches a 2–16 item event sequence inside the duration. `ordered = true` requires listed order; `false` permits any order.
`eventCount`	`within`, `where`, `op`, `value`	Counts prior events matching `where` and compares that count.
`priorDistinctValues`	`within`, `field`, `op`, `value`; optional `where`	Counts distinct non-null values of a Content field among prior events, optionally filtered by `where`, then compares the count.

within must be a positive integer followed by s, m, h, or d, such as 30s, 15m, 12h, or 7d, and cannot exceed 30 days. Count op is eq, gt, gte, lt, or lte; count value is an integer from 0 through 1,024.

conditions = {
  eventCount = {
    within = "15m"
    where  = { field = "tool.id", op = "eq", value = "customer.export" }
    op     = "gte"
    value  = 3
  }
}

The provider validates structure, family fields, enums, limits, durations, and regular expressions locally. Forge then applies the complete policy contract and runtime type rules authoritatively during the resource write. This second check prevents an older provider from weakening or reinterpreting a newer server contract.

`forge_content_policy`

Attribute	Requirement and type	Exact meaning
`service_accounts`	Optional set(string), max 256	Exact service-account names resolved into Content scope.
`agents`	Optional set(string), max 256	Exact agent names/labels resolved into Content scope.
`products`	Optional set(string), max 256	Exact product names/slugs resolved into Content scope.
`evaluate_on`	Required ordered list, 1–4 unique values	Control points at which to evaluate: `prompt` before submission; `pre_tool` before execution; `post_tool` after execution and before reuse; `response` on model output.
`action`	Required enum	`allow`, `nudge`, `flag_for_review`, `redact`, `filter`, `require_approval`, or `block`, with behavior defined in Actions.
`redaction_strategy`	Required for `action = "redact"`; defaults to `constant` if omitted by provider compatibility logic	`constant`, `partial`, `hash`, `nullify`, or `fake`. No redaction attribute is valid for another action.
`redaction_replacement`	Required string for `constant`	Exact replacement string; empty is allowed.
`redaction_paths`	Optional set(string), 1–64 when present	Unique bounded paths. Omit to transform the whole control-point value.
`redaction_keep_start`	Optional integer 0–256	Prefix characters retained by `partial`; at least one keep attribute is required.
`redaction_keep_end`	Optional integer 0–256	Suffix characters retained by `partial`; at least one keep attribute is required.
`redaction_mask_character`	Optional one-character string	Mask used by `partial`; defaults to `*`.
`redaction_salt_ref`	Optional identifier	Domain-separation label used by `hash`; it is not secret material.
`redaction_fake_subtype`	Required for `fake`	`string`, `email`, `phone`, `ipv4`, or `payment_card`.
`filter_collection_path`	Required for `action = "filter"`	Bounded path to the post-tool array being filtered.
`filter_path`	Required for `filter`	Bounded path evaluated from each collection element.
`filter_operator`	Required for `filter`	`eq`, `neq`, `contains`, `starts_with`, `ends_with`, `gt`, `gte`, `lt`, or `lte`.
`filter_value`	Required dynamic value for `filter`	Type-preserving HCL value compared by the predicate. It may be a scalar, collection, or object, although the selected operator must support the runtime type.
`filter_on_unavailable`	Required for `filter`	`allow` leaves the original result unchanged; `block` blocks when the configured paths cannot be evaluated.

The response checkpoint is endpoint- and capability-dependent. The LLM Gateway does not provide it. Timing constraints still apply: approval is pre_tool only, filtering is post_tool only, and path redaction is pre_tool or post_tool only.

`forge_access_policy`

Attribute	Requirement and type	Exact meaning
`devices`	Optional set(string), max 256	Exact device names resolved into Access scope.
`enforced_by`	Optional set(string), max 256	Exact integration names resolved authoritatively by Forge. Missing or ambiguous names fail the plan/apply rather than falling back to another integration.
`enforcement_surfaces`	Required set(enum), 1–3	Runtime surfaces that can execute the result: `inline_hook`, `endpoint_route`, or `provider`.
`severity`	Optional enum	`low`, `medium`, `high`, or `critical`; defaults to `medium`.
`acknowledge_broad_scope`	Optional boolean	Defaults to `false`. Must be explicitly enabled when Forge identifies an enabled disruptive policy with broad scope.
`action`	Required enum	`allow`, `flag_for_review`, `require_approval`, or `block`.
`approval_mode`	Optional enum	`admin_approval` or `self_serve`; defaults to `admin_approval`. Valid only where approval applies.
`runtime`	Optional native HCL object	Runtime selection and failure behavior: `candidateMode`, `detectionMode`, `detectionLatencyMs`, `timeoutBehavior`, `failBehavior`, and `confidenceThreshold`.
`notification`	Optional native HCL object	Structured Access notification contract. Its fields and acknowledgement rules are defined in Schema.
`remediation`	Optional native HCL object	Structured remediation contract containing `triggerPhase`, `applyWhenClassification`, and one or more actions with their typed parameters.

Content and Access expose only their own family attributes. Terraform rejects cross-family fields instead of silently discarding or retaining them as null state.

Content Rego example

resource "forge_content_policy" "customer_export" {
  id          = "customer-export"
  name        = "Protect customer exports"
  groups      = ["Finance"]
  evaluate_on = ["pre_tool"]
  action      = "block"

  module = <<-REGO
    package forge.content
    match := {
      "matched": input.tool.id == "customer.export",
      "reasonCode": "customer_export",
    }
  REGO
}

The complete action, evaluation-point, and action-specific attribute semantics are defined in forge_content_policy. Invalid cross-field combinations fail planning or server validation.

Readable references

Use exact user email and exact group, product, agent, route, MCP server/tool, or skill name/slug. Forge resolves names authoritatively. Missing and ambiguous matches fail apply rather than choosing arbitrarily. Forge retains the resolved bindings while refresh preserves readable configuration. Every policy resource with user or group subjects can disambiguate duplicate directory labels without putting a Forge object ID in configuration:

users = ["alex@example.com"]
user_directory_ids = {
  "alex@example.com" = "directory-primary"
}

group_directory_ids works the same way for configured group names. Every map key must also appear in its matching users or groups set; empty qualifiers and unsupported names fail before mutation. Most organizations should omit these maps and use the concise unique email/name form. The same fields are available on MCP ACLs and skill ACLs. Policy id is different: it is a user-chosen durable key, immutable after creation and never reusable after deletion. Choose a stable, descriptive slug.

Import

Policy resources import by their durable policy ID:

terraform import forge_content_policy.customer_export customer-export
terraform import forge_access_policy.unmanaged_ai unmanaged-ai

Import reads the remote definition but does not claim authority. For a Forge-managed policy, first apply a matching forge_policy_authority resource at the exact reviewed revision, then import the policy into the same Terraform manager. After import, run a connected terraform plan and reproduce the complete remote scope, condition or module, action, and action-specific configuration in HCL. Omitted attributes are desired changes, not instructions to preserve unknown remote configuration.

Guides

REST API

Policy Resources

Content and Access policy attributes

Native condition language

Field catalog

`forge_content_policy`

`forge_access_policy`

Content Rego example

Readable references

Import

​Content and Access policy attributes

​Native condition language

​Field catalog

​forge_content_policy

​forge_access_policy

​Content Rego example

​Readable references

​Import

Content and Access policy attributes

Native condition language

Field catalog

`forge_content_policy`

`forge_access_policy`

Content Rego example

Readable references

Import