Conditions

Conditions determine whether a policy matches. A policy can use either a typed native condition tree or Rego, never both.

Condition shapes

A condition tree contains exactly one of the following shapes at each node.

Shape	Input	Output
Field comparison	`field`, `op`, and `value` unless `op` is `exists`	`true` when the typed comparison succeeds
`all`	Non-empty array of conditions	`true` when every child matches
`any`	Non-empty array of conditions	`true` when at least one child matches
`not`	One condition	Negates the child result
`hasPriorEvent`	One Content condition	`true` when any prior event in the session matches
`hasEventSequence`	`within`, `ordered`, and 2–16 Content event conditions	`true` when prior events satisfy the sequence
`eventCount`	`within`, `where`, count operator, and integer threshold	Compares the number of matching prior events
`priorDistinctValues`	`within`, `field`, optional `where`, count operator, integer threshold	Compares distinct prior values for a Content field

all and any accept 1–64 children. Trees support at most 16 levels and 512 total nodes. Session-aware shapes are available only to Content policies.

{
  "all": [
    { "field": "tool.id", "op": "eq", "value": "Shell" },
    {
      "any": [
        {
          "field": "tool.input.command",
          "op": "contains",
          "value": "production"
        },
        {
          "field": "classification.sensitivity_labels",
          "op": "contains",
          "value": "credential"
        }
      ]
    }
  ]
}

Operators

Operators are type-checked when the policy is saved. Forge does not coerce strings into numbers, booleans, or collections.

Value type	Valid operators
`string`	`eq`, `neq`, `in`, `not_in`, `contains`, `starts_with`, `ends_with`, `matches`, `exists`
`string_set`	`eq`, `neq`, `contains`, `contains_any`, `contains_all`, `exists`
`number`	`eq`, `neq`, `in`, `not_in`, `gt`, `gte`, `lt`, `lte`, `exists`
`boolean`	`eq`, `neq`, `exists`
`object`	`exists`
`content`	`eq`, `neq`, `contains`, `starts_with`, `ends_with`, `matches`, `exists`

matches uses a regular-expression string. exists requires no value and matches only when the field is present and non-null. A missing field causes other comparisons to return false; it is not treated as an empty value. Regular expressions are limited to 1,024 bytes.

Content fields

Content facts are supplied by the enforcing surface. A field is omitted when that surface cannot observe it.

Field	Type	Value supplied to the policy
`identity.user_id`	string	Canonical attributed user
`identity.group_ids`	string set	Canonical groups resolved for the user
`identity.service_account_id`	string	Attributed LLM Gateway service account
`request.prompt`	string	Submitted prompt at the `prompt` checkpoint
`event.kind`	string	Normalized event type
`event.title`	string	Source-provided event title
`event.summary`	string	Source-provided event summary; Forge does not synthesize it for evaluation
`event.labels`	string set	Normalized event labels
`event.severity`	string	Source-provided normalized severity
`tool.server_id`	string	Server or connector that exposed the tool
`tool.id`	string	Normalized tool name or identity
`tool.input`	content	Structured tool arguments; secret-like values are excluded from evidence
`tool.input.command`	string	Recognized command argument
`tool.input.file_path`	string	Recognized file-path argument
`tool.input.url`	string	Recognized URL or URI argument
`tool.input.workdir`	string	Recognized working-directory argument
`tool.input.approval`	string	Approval or permission state explicitly reported in tool arguments
`tool.input.env`	content	Environment-variable names; values are not exposed
`tool.input.surface_kind`	string	Source-reported governed surface type
`tool.input.surface_key`	string	Source-reported stable surface key
`tool.result`	content	Structured or scalar result at `post_tool`
`response.content`	string	Model output supplied by a surface that supports `response`
`classification.sensitivity_labels`	string set	Sensitivity labels produced by Forge classification
`classification.data_labels`	string set	Normalized data labels
`classification.categories`	string set	Normalized content categories
`classification.data_source_kinds`	string set	Sources supporting the classification
`classification.proof_strength`	string	Evidence-strength label
`classification.provider_actions`	string set	Provider-native moderation or safety actions
`classification.has_unresolved_sensitive_content`	boolean	Whether sensitive content remains after available transformations
`mcp.server_id`	string	Stable MCP Registry server ID
`mcp.tool_id`	string	Stable MCP Registry tool ID
`mcp.gateway_endpoint_id`	string	MCP Gateway endpoint ID
`mcp.package_id`	string	Discovered or registered package identity
`mcp.package_version`	string	Source-reported package version
`mcp.remote_url`	string	Normalized upstream URL without credentials or fragments
`llm.model`	string	Normalized model
`llm.provider`	string	Normalized upstream provider
`llm.input_tokens`	number	Reported input tokens
`llm.output_tokens`	number	Reported output tokens when a surface supports `response`

Registered custom Content fields extend tool.input with a field name, label, value type, and source provenance. Forge validates their descriptors and makes them available to the same native condition engine. The response checkpoint depends on the routed API surface and its response adapter.

Access fields

Field	Type	Value supplied to the policy
`identity.user_id`	string	Canonical attributed user
`identity.group_ids`	string set	Canonical groups resolved for the user
`device.id`	string	Stable Forge device identity
`device.platform`	string	Normalized platform
`product.id`	string	Resolved AI product identity
`provider.id`	string	Resolved provider identity
`destination.domain`	string	Normalized hostname without scheme, path, query, or credentials
`destination.ip`	string	Observed IPv4 or IPv6 address
`destination.port`	number	Observed destination port
`process.id`	string	Stable process identity, not a reusable OS PID
`process.entrypoint_id`	string	Stable identity of the initiating executable
`process.name`	string	Observed process name
`process.path`	string	Observed executable path
`process.local_port`	number	Attributed local port
`browser.extension_id`	string	Browser-native extension identifier
`browser.extension_identity_id`	string	Forge identity joining the same extension across observations
`browser.extension_surface`	string	Browser surface where the extension was observed
`browser.account_id`	string	Privacy-bounded attributed account identity
`browser.account_domain`	string	Normalized account domain
`browser.account_state`	string	`company_account`, `personal_account`, `service_account`, or unknown state
`browser.account_truth_state`	string	Evidence state from `hinted` or `inferred` through `proven`
`classification.state`	string	AI recognition result
`route.posture`	string	Governance posture of the observed route
`account.posture`	string	SSO or account-verification posture
`account.access_state`	string	Whether the attributed account is approved for the access
`account.profile_id`	string set	Resolved access-profile identities
`control.path_kind`	string	Control path capable of enforcing the decision
`source.family`	string	Integration or endpoint evidence family
`source.capability`	string set	Concrete capabilities reported by the source
`source.health_state`	string	`active`, `degraded`, `stale`, `missing`, `disabled`, or `unhealthy`
`local_model.governance_state`	string	`approved`, `unknown`, or `disallowed`
`local_model.proof_level`	string	Whether use is declared, available, running, or unknown
`local_model.name`	string set	Normalized local model names

The complete enums for account, classification, route, and local-model posture are exposed by the policy schema used by the Console, API, and Terraform provider.

Session conditions

Windows use a positive duration such as 5m, 2h, or 7d and cannot exceed 30 days.

{
  "eventCount": {
    "within": "15m",
    "where": {
      "field": "classification.sensitivity_labels",
      "op": "contains",
      "value": "credential"
    },
    "gte": 3
  }
}

Count shapes accept exactly one of eq, gt, gte, lt, or lte, with an integer threshold from 0–1,024. hasEventSequence.ordered controls whether the specified events must appear in the same order. These operators inspect prior events made available to the evaluation; they do not query arbitrary historical data.

Exceptions

except uses the same native condition grammar as conditions. Forge evaluates it only after the primary condition matches. A matching exception suppresses the policy hit; it cannot independently create an allow decision or override another policy.

Get started

Observe

Secure

Enable

Integrations

Resources

Condition shapes

Operators

Content fields

Access fields

Session conditions

Exceptions

​Condition shapes

​Operators

​Content fields

​Access fields

​Session conditions

​Exceptions

Condition shapes

Operators

Content fields

Access fields

Session conditions

Exceptions