> ## Documentation Index > Fetch the complete documentation index at: https://docs.forge.ai/llms.txt > Use this file to discover all available pages before exploring further. # Policy Resources > Terraform resources for Content and Access policies, native conditions, actions, and readable references. ### Content and Access policy attributes Both policy resources require exactly one match representation. `module` uses Policy-as-code. `conditions` uses the complete native condition language as native HCL objects, tuples, and values. No JSON encoding or escaping is needed. Shared attributes are: | Attribute | Requirement and type | Exact meaning | | ------------------------- | ----------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `id` | Required string, 1–256 characters; forces replacement | Immutable, user-chosen policy identity. Must begin alphanumeric and may then contain letters, digits, `.`, `_`, `:`, `@`, `/`, or `-`. | | `name` | Required non-empty string | Mutable display name; not used for Terraform identity or references. | | `description` | Optional non-empty string | Human explanation stored with the revision. | | `rationale` | Optional non-empty string | Why the policy exists. It is revisioned metadata and does not change matching by itself. | | `use_cases` | Optional set(string), max 9 | Product use-case tags: `Data Encryption`, `Public Exposure`, `Data Sprawl`, `Organizational Access`, `Resilience`, `Runtime Safety`, `Credential Risk`, `AI Model Governance`, or `Shadow AI`. | | `compliance_frameworks` | Optional set(string), max 8 | Framework tags: `Security Basics`, `NIST`, `CIS`, `GDPR`, `HIPAA`, `PCI DSS`, `SOC 2`, or `OWASP`. | | `labels` | Optional set(string), max 256 | Free-form non-empty revision labels for ownership, environment, and search. Labels do not affect matching. | | `enabled` | Optional boolean; default `true` | Whether the revision participates in new evaluations. Disabling preserves history and identity. | | `users` | Optional set(string), max 256 | Exact user emails resolved at apply. Empty/omitted means this scope dimension does not restrict the policy. | | `groups` | Optional set(string), max 256 | Exact group names resolved at apply. | | `user_directory_ids` | Optional map(string), max 256 | Maps a configured user email to a directory ID only when duplicate exact email matches need disambiguation. Every key must also be in `users`. | | `group_directory_ids` | Optional map(string), max 256 | Maps a configured group name to a directory ID only when duplicate exact name matches need disambiguation. Every key must also be in `groups`. | | `module` | Optional string, 1 byte–256 KiB | Exact `forge.rego.v1` source for the family package; mutually exclusive with `conditions`. | | `conditions` | Optional native HCL object | Complete recursive native condition tree; mutually exclusive with `module`. Terraform retains its structure in plans and state. | | `except` | Optional native HCL object | Complete recursive condition tree using the same family fields. A match suppresses this policy after its primary condition or Rego match succeeds. | | `action` | Required enum | Typed consequence applied when the selected match representation succeeds; family values are below. | | `message` | Optional non-empty string | Content: user-facing consequence guidance. Access: enforcement notification text. | | `auto_approve_on_request` | Optional boolean | Valid only with `require_approval`. `true` still creates a request before issuing its revision-bound scoped grant. Omitted is false. | | `current_revision` | Computed integer | Latest immutable server revision observed by Terraform and used for optimistic updates/deletes. | | `definition_sha256` | Computed SHA-256 | Digest of the server-canonical complete policy definition. | | `module_sha256` | Computed SHA-256 or null | Digest of exact Rego source; null for native conditions. | | `validation_token` | Computed sensitive string | Short-lived signed binding for the reviewed plan. Provider-managed and retained as sensitive state solely for Terraform plan/apply consistency. | ### Native condition language Every condition is one HCL object. A predicate compares one canonical field: ```hcl theme={"system"} conditions = { field = "request.prompt" op = "contains" value = "confidential" } ``` Use `all` when every child must match, `any` when at least one must match, and `not` to invert one child. `all` and `any` each accept 1–64 condition objects. Trees may contain at most 512 nodes and 16 levels. ```hcl theme={"system"} conditions = { all = [ { field = "device.platform", op = "eq", value = "darwin" }, { not = { field = "device.id" op = "in" value = ["break-glass-device"] } } ] } ``` Predicate properties are exact; extra properties are rejected: | Property | Requirement | Meaning | | -------- | ---------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------- | | `field` | Required string | A field from the family catalog below. | | `op` | Required enum | One operator from the table below. | | `value` | Required except for `exists`; forbidden for `exists` | A type-preserving HCL scalar, tuple, object, or collection. The operator and field determine valid runtime types. | | Operator | Exact test | | --------------------------- | --------------------------------------------------------------------------------------------------------------------- | | `eq` / `neq` | Field is equal / not equal to `value`. Objects and collections compare structurally. | | `in` / `not_in` | Field is / is not a member of the collection in `value`. | | `contains` | String contains a substring, or collection contains one value. | | `contains_any` | Collection contains at least one member supplied by `value`. | | `contains_all` | Collection contains every member supplied by `value`. | | `starts_with` / `ends_with` | String starts / ends with the supplied string. | | `matches` | String matches the RE2 regular expression in `value`; patterns are limited to 1,024 bytes and validated before apply. | | `gt` / `gte` / `lt` / `lte` | Ordered field is greater than / at least / less than / at most `value`. | | `exists` | Field is present and non-null. Omit `value`. | #### Field catalog Terraform accepts the same canonical native-condition fields as the policy engine. The catalog is grouped by namespace so plans remain readable: | Family | Namespace | What it contains | | ------- | ------------------------------------- | ----------------------------------------------------------------------------------------------- | | Content | `identity.*` | Human, group, and service-account bindings used during evaluation. | | Content | `request.*`, `response.*` | Prompt input and model output available when the selected stage is supported. | | Content | `event.*` | Source event kind, title, summary, labels, and severity. | | Content | `tool.*` | Tool identity, sanitized inputs, paths, commands, destinations, environment names, and results. | | Content | `classification.*` | Sensitivity, data, category, provenance, proof, and unresolved-content signals. | | Content | `mcp.*`, `llm.*` | MCP package/server/tool facts and model/provider/token facts. | | Access | `identity.*`, `device.*`, `product.*` | Subject, endpoint, and application bindings. | | Access | `destination.*`, `process.*` | Network destination and local-process facts. | | Access | `browser.*` | Extension and browser-account facts. | See [Conditions](/secure/conditions#content-facts) for every accepted field, its exact type, meaning, availability, and the separate Access catalog. A field from the other policy family is rejected. Content policies additionally support history-aware operators: | Operator | Required object properties | Exact meaning | | --------------------- | -------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------- | | `hasPriorEvent` | One nested condition object | Matches when any earlier event in the evaluation history matches the child. | | `hasEventSequence` | `within`, `ordered`, `events` | Matches a 2–16 item event sequence inside the duration. `ordered = true` requires listed order; `false` permits any order. | | `eventCount` | `within`, `where`, `op`, `value` | Counts prior events matching `where` and compares that count. | | `priorDistinctValues` | `within`, `field`, `op`, `value`; optional `where` | Counts distinct non-null values of a Content field among prior events, optionally filtered by `where`, then compares the count. | `within` must be a positive integer followed by `s`, `m`, `h`, or `d`, such as `30s`, `15m`, `12h`, or `7d`, and cannot exceed 30 days. Count `op` is `eq`, `gt`, `gte`, `lt`, or `lte`; count `value` is an integer from 0 through 1,024. ```hcl theme={"system"} conditions = { eventCount = { within = "15m" where = { field = "tool.id", op = "eq", value = "customer.export" } op = "gte" value = 3 } } ``` The provider validates structure, family fields, enums, limits, durations, and regular expressions locally. Forge then applies the complete policy contract and runtime type rules authoritatively during the resource write. This second check prevents an older provider from weakening or reinterpreting a newer server contract. #### `forge_content_policy` | Attribute | Requirement and type | Exact meaning | | -------------------------- | --------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `service_accounts` | Optional set(string), max 256 | Exact service-account names resolved into Content scope. | | `agents` | Optional set(string), max 256 | Exact agent names/labels resolved into Content scope. | | `products` | Optional set(string), max 256 | Exact product names/slugs resolved into Content scope. | | `evaluate_on` | Required ordered list, 1–4 unique values | Control points at which to evaluate: `prompt` before submission; `pre_tool` before execution; `post_tool` after execution and before reuse; `response` on model output. | | `action` | Required enum | `allow`, `nudge`, `flag_for_review`, `redact`, `filter`, `require_approval`, or `block`, with behavior defined in [Actions](/secure/actions). | | `redaction_strategy` | Required for `action = "redact"`; defaults to `constant` if omitted by provider compatibility logic | `constant`, `partial`, `hash`, `nullify`, or `fake`. No redaction attribute is valid for another action. | | `redaction_replacement` | Required string for `constant` | Exact replacement string; empty is allowed. | | `redaction_paths` | Optional set(string), 1–64 when present | Unique bounded paths. Omit to transform the whole control-point value. | | `redaction_keep_start` | Optional integer 0–256 | Prefix characters retained by `partial`; at least one keep attribute is required. | | `redaction_keep_end` | Optional integer 0–256 | Suffix characters retained by `partial`; at least one keep attribute is required. | | `redaction_mask_character` | Optional one-character string | Mask used by `partial`; defaults to `*`. | | `redaction_salt_ref` | Optional identifier | Domain-separation label used by `hash`; it is not secret material. | | `redaction_fake_subtype` | Required for `fake` | `string`, `email`, `phone`, `ipv4`, or `payment_card`. | | `filter_collection_path` | Required for `action = "filter"` | Bounded path to the post-tool array being filtered. | | `filter_path` | Required for `filter` | Bounded path evaluated from each collection element. | | `filter_operator` | Required for `filter` | `eq`, `neq`, `contains`, `starts_with`, `ends_with`, `gt`, `gte`, `lt`, or `lte`. | | `filter_value` | Required dynamic value for `filter` | Type-preserving HCL value compared by the predicate. It may be a scalar, collection, or object, although the selected operator must support the runtime type. | | `filter_on_unavailable` | Required for `filter` | `allow` leaves the original result unchanged; `block` blocks when the configured paths cannot be evaluated. | The `response` checkpoint is endpoint- and capability-dependent. The LLM Gateway does not provide it. Timing constraints still apply: approval is `pre_tool` only, filtering is `post_tool` only, and path redaction is `pre_tool` or `post_tool` only. #### `forge_access_policy` | Attribute | Requirement and type | Exact meaning | | ------------------------- | ----------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `devices` | Optional set(string), max 256 | Exact device names resolved into Access scope. | | `enforced_by` | Optional set(string), max 256 | Exact integration names resolved authoritatively by Forge. Missing or ambiguous names fail the plan/apply rather than falling back to another integration. | | `enforcement_surfaces` | Required set(enum), 1–3 | Runtime surfaces that can execute the result: `inline_hook`, `endpoint_route`, or `provider`. | | `severity` | Optional enum | `low`, `medium`, `high`, or `critical`; defaults to `medium`. | | `acknowledge_broad_scope` | Optional boolean | Defaults to `false`. Must be explicitly enabled when Forge identifies an enabled disruptive policy with broad scope. | | `action` | Required enum | `allow`, `flag_for_review`, `require_approval`, or `block`. | | `approval_mode` | Optional enum | `admin_approval` or `self_serve`; defaults to `admin_approval`. Valid only where approval applies. | | `runtime` | Optional native HCL object | Runtime selection and failure behavior: `candidateMode`, `detectionMode`, `detectionLatencyMs`, `timeoutBehavior`, `failBehavior`, and `confidenceThreshold`. | | `notification` | Optional native HCL object | Structured Access notification contract. Its fields and acknowledgement rules are defined in [Schema](/secure/schema#notification-fields). | | `remediation` | Optional native HCL object | Structured remediation contract containing `triggerPhase`, `applyWhenClassification`, and one or more actions with their typed parameters. | Content and Access expose only their own family attributes. Terraform rejects cross-family fields instead of silently discarding or retaining them as null state. ## Content Rego example ```hcl theme={"system"} resource "forge_content_policy" "customer_export" { id = "customer-export" name = "Protect customer exports" groups = ["Finance"] evaluate_on = ["pre_tool"] action = "block" module = <<-REGO package forge.content match := { "matched": input.tool.id == "customer.export", "reasonCode": "customer_export", } REGO } ``` The complete action, evaluation-point, and action-specific attribute semantics are defined in [`forge_content_policy`](#forge_content_policy). Invalid cross-field combinations fail planning or server validation. ## Readable references Use exact user email and exact group, product, agent, route, MCP server/tool, or skill name/slug. Forge resolves names authoritatively. Missing and ambiguous matches fail apply rather than choosing arbitrarily. Forge retains the resolved bindings while refresh preserves readable configuration. Every policy resource with user or group subjects can disambiguate duplicate directory labels without putting a Forge object ID in configuration: ```hcl theme={"system"} users = ["alex@example.com"] user_directory_ids = { "alex@example.com" = "directory-primary" } ``` `group_directory_ids` works the same way for configured group names. Every map key must also appear in its matching `users` or `groups` set; empty qualifiers and unsupported names fail before mutation. Most organizations should omit these maps and use the concise unique email/name form. The same fields are available on MCP ACLs and skill ACLs. Policy `id` is different: it is a user-chosen durable key, immutable after creation and never reusable after deletion. Choose a stable, descriptive slug. ## Import Policy resources import by their durable policy ID: ```bash theme={"system"} terraform import forge_content_policy.customer_export customer-export terraform import forge_access_policy.unmanaged_ai unmanaged-ai ``` Import reads the remote definition but does not claim authority. For a Forge-managed policy, first apply a matching `forge_policy_authority` resource at the exact reviewed revision, then import the policy into the same Terraform manager. After import, run a connected `terraform plan` and reproduce the complete remote scope, condition or module, action, and action-specific configuration in HCL. Omitted attributes are desired changes, not instructions to preserve unknown remote configuration.