> ## Documentation Index > Fetch the complete documentation index at: https://docs.forge.ai/llms.txt > Use this file to discover all available pages before exploring further. # Conditions > Native policy fields, operators, boolean logic, exceptions, and session-aware conditions. Conditions determine whether a policy matches. A policy can use either a typed native condition tree or [Rego](/secure/rego), never both. ## Condition shapes A condition tree contains exactly one of the following shapes at each node. | Shape | Input | Output | | --------------------- | ---------------------------------------------------------------------- | -------------------------------------------------- | | Field comparison | `field`, `op`, and `value` unless `op` is `exists` | `true` when the typed comparison succeeds | | `all` | Non-empty array of conditions | `true` when every child matches | | `any` | Non-empty array of conditions | `true` when at least one child matches | | `not` | One condition | Negates the child result | | `hasPriorEvent` | One Content condition | `true` when any prior event in the session matches | | `hasEventSequence` | `within`, `ordered`, and 2–16 Content event conditions | `true` when prior events satisfy the sequence | | `eventCount` | `within`, `where`, count operator, and integer threshold | Compares the number of matching prior events | | `priorDistinctValues` | `within`, `field`, optional `where`, count operator, integer threshold | Compares distinct prior values for a Content field | `all` and `any` accept 1–64 children. Trees support at most 16 levels and 512 total nodes. Session-aware shapes are available only to Content policies. ```json theme={"system"} { "all": [ { "field": "tool.id", "op": "eq", "value": "Shell" }, { "any": [ { "field": "tool.input.command", "op": "contains", "value": "production" }, { "field": "classification.sensitivity_labels", "op": "contains", "value": "credential" } ] } ] } ``` ## Operators Operators are type-checked when the policy is saved. Forge does not coerce strings into numbers, booleans, or collections. | Value type | Valid operators | | ------------ | ---------------------------------------------------------------------------------------- | | `string` | `eq`, `neq`, `in`, `not_in`, `contains`, `starts_with`, `ends_with`, `matches`, `exists` | | `string_set` | `eq`, `neq`, `contains`, `contains_any`, `contains_all`, `exists` | | `number` | `eq`, `neq`, `in`, `not_in`, `gt`, `gte`, `lt`, `lte`, `exists` | | `boolean` | `eq`, `neq`, `exists` | | `object` | `exists` | | `content` | `eq`, `neq`, `contains`, `starts_with`, `ends_with`, `matches`, `exists` | `matches` uses a regular-expression string. `exists` requires no `value` and matches only when the field is present and non-null. A missing field causes other comparisons to return false; it is not treated as an empty value. Regular expressions are limited to 1,024 bytes. ## Content fields Content facts are supplied by the enforcing surface. A field is omitted when that surface cannot observe it. | Field | Type | Value supplied to the policy | | ------------------------------------------------- | ---------- | -------------------------------------------------------------------------- | | `identity.user_id` | string | Canonical attributed user | | `identity.group_ids` | string set | Canonical groups resolved for the user | | `identity.service_account_id` | string | Attributed LLM Gateway service account | | `request.prompt` | string | Submitted prompt at the `prompt` checkpoint | | `event.kind` | string | Normalized event type | | `event.title` | string | Source-provided event title | | `event.summary` | string | Source-provided event summary; Forge does not synthesize it for evaluation | | `event.labels` | string set | Normalized event labels | | `event.severity` | string | Source-provided normalized severity | | `tool.server_id` | string | Server or connector that exposed the tool | | `tool.id` | string | Normalized tool name or identity | | `tool.input` | content | Structured tool arguments; secret-like values are excluded from evidence | | `tool.input.command` | string | Recognized command argument | | `tool.input.file_path` | string | Recognized file-path argument | | `tool.input.url` | string | Recognized URL or URI argument | | `tool.input.workdir` | string | Recognized working-directory argument | | `tool.input.approval` | string | Approval or permission state explicitly reported in tool arguments | | `tool.input.env` | content | Environment-variable names; values are not exposed | | `tool.input.surface_kind` | string | Source-reported governed surface type | | `tool.input.surface_key` | string | Source-reported stable surface key | | `tool.result` | content | Structured or scalar result at `post_tool` | | `response.content` | string | Model output supplied by a surface that supports `response` | | `classification.sensitivity_labels` | string set | Sensitivity labels produced by Forge classification | | `classification.data_labels` | string set | Normalized data labels | | `classification.categories` | string set | Normalized content categories | | `classification.data_source_kinds` | string set | Sources supporting the classification | | `classification.proof_strength` | string | Evidence-strength label | | `classification.provider_actions` | string set | Provider-native moderation or safety actions | | `classification.has_unresolved_sensitive_content` | boolean | Whether sensitive content remains after available transformations | | `mcp.server_id` | string | Stable MCP Registry server ID | | `mcp.tool_id` | string | Stable MCP Registry tool ID | | `mcp.gateway_endpoint_id` | string | MCP Gateway endpoint ID | | `mcp.package_id` | string | Discovered or registered package identity | | `mcp.package_version` | string | Source-reported package version | | `mcp.remote_url` | string | Normalized upstream URL without credentials or fragments | | `llm.model` | string | Normalized model | | `llm.provider` | string | Normalized upstream provider | | `llm.input_tokens` | number | Reported input tokens | | `llm.output_tokens` | number | Reported output tokens when a surface supports `response` | Registered custom Content fields extend `tool.input` with a field name, label, value type, and source provenance. Forge validates their descriptors and makes them available to the same native condition engine. The `response` checkpoint depends on the routed API surface and its response adapter. ## Access fields | Field | Type | Value supplied to the policy | | ------------------------------- | ---------- | -------------------------------------------------------------------------- | | `identity.user_id` | string | Canonical attributed user | | `identity.group_ids` | string set | Canonical groups resolved for the user | | `device.id` | string | Stable Forge device identity | | `device.platform` | string | Normalized platform | | `product.id` | string | Resolved AI product identity | | `provider.id` | string | Resolved provider identity | | `destination.domain` | string | Normalized hostname without scheme, path, query, or credentials | | `destination.ip` | string | Observed IPv4 or IPv6 address | | `destination.port` | number | Observed destination port | | `process.id` | string | Stable process identity, not a reusable OS PID | | `process.entrypoint_id` | string | Stable identity of the initiating executable | | `process.name` | string | Observed process name | | `process.path` | string | Observed executable path | | `process.local_port` | number | Attributed local port | | `browser.extension_id` | string | Browser-native extension identifier | | `browser.extension_identity_id` | string | Forge identity joining the same extension across observations | | `browser.extension_surface` | string | Browser surface where the extension was observed | | `browser.account_id` | string | Privacy-bounded attributed account identity | | `browser.account_domain` | string | Normalized account domain | | `browser.account_state` | string | `company_account`, `personal_account`, `service_account`, or unknown state | | `browser.account_truth_state` | string | Evidence state from `hinted` or `inferred` through `proven` | | `classification.state` | string | AI recognition result | | `route.posture` | string | Governance posture of the observed route | | `account.posture` | string | SSO or account-verification posture | | `account.access_state` | string | Whether the attributed account is approved for the access | | `account.profile_id` | string set | Resolved access-profile identities | | `control.path_kind` | string | Control path capable of enforcing the decision | | `source.family` | string | Integration or endpoint evidence family | | `source.capability` | string set | Concrete capabilities reported by the source | | `source.health_state` | string | `active`, `degraded`, `stale`, `missing`, `disabled`, or `unhealthy` | | `local_model.governance_state` | string | `approved`, `unknown`, or `disallowed` | | `local_model.proof_level` | string | Whether use is declared, available, running, or unknown | | `local_model.name` | string set | Normalized local model names | The complete enums for account, classification, route, and local-model posture are exposed by the policy schema used by the Console, API, and Terraform provider. ## Session conditions Windows use a positive duration such as `5m`, `2h`, or `7d` and cannot exceed 30 days. ```json theme={"system"} { "eventCount": { "within": "15m", "where": { "field": "classification.sensitivity_labels", "op": "contains", "value": "credential" }, "gte": 3 } } ``` Count shapes accept exactly one of `eq`, `gt`, `gte`, `lt`, or `lte`, with an integer threshold from 0–1,024. `hasEventSequence.ordered` controls whether the specified events must appear in the same order. These operators inspect prior events made available to the evaluation; they do not query arbitrary historical data. ## Exceptions `except` uses the same native condition grammar as `conditions`. Forge evaluates it only after the primary condition matches. A matching exception suppresses the policy hit; it cannot independently create an allow decision or override another policy.