Examples

The definitions below use the same schemas as the Forge Console, API, and Terraform provider. Replace example identifiers with values resolved from your own Forge organization.

Tool approval

This Content policy pauses a selected tool before execution and creates an administrator approval request.

{
  "id": "restricted-tool-approval",
  "name": "Restricted tool approval",
  "description": "Require approval before a high-risk tool executes.",
  "rationale": "Place a human decision between an agent and a destructive capability.",
  "enabled": true,
  "appliesTo": {
    "groups": ["Engineering"]
  },
  "evaluateOn": ["pre_tool"],
  "conditions": {
    "field": "tool.id",
    "op": "eq",
    "value": "Shell"
  },
  "action": "require_approval",
  "approval": {
    "autoApproveOnRequest": false
  },
  "message": "This tool requires approval before it can run."
}

require_approval requires exactly evaluateOn: ["pre_tool"]. The group name is resolved to a canonical directory binding when the policy is saved.

Result filtering

This Content policy removes objects classified as sensitive from a structured tool-result array.

{
  "id": "sensitive-result-filter",
  "name": "Sensitive result filter",
  "enabled": true,
  "appliesTo": {},
  "evaluateOn": ["post_tool"],
  "conditions": {
    "field": "tool.result",
    "op": "exists"
  },
  "action": "filter",
  "filter": {
    "collectionPath": "$.rows",
    "removeWhere": {
      "path": "$.classification",
      "op": "eq",
      "value": "sensitive"
    },
    "onUnavailable": "block"
  }
}

The policy acts only on tool results whose root contains a rows array. onUnavailable: "block" prevents the original unfiltered result from continuing if the expected structure is absent.

MCP control

This Content policy blocks one MCP tool for a selected group.

{
  "id": "block-destructive-mcp-tool",
  "name": "Block destructive MCP tool",
  "enabled": true,
  "appliesTo": {
    "groups": ["Contractors"]
  },
  "evaluateOn": ["pre_tool"],
  "conditions": {
    "all": [
      {
        "field": "mcp.server_id",
        "op": "eq",
        "value": "registry-server-id"
      },
      {
        "field": "mcp.tool_id",
        "op": "eq",
        "value": "registry-tool-id"
      }
    ]
  },
  "action": "block",
  "message": "This MCP tool is not available to your group."
}

Use the stable Registry IDs supplied by Forge. A tool condition must identify exactly one parent MCP server.

Destination block

This Access policy blocks an AI destination at the endpoint route and provides a user-facing notification.

{
  "id": "unapproved-ai-destination",
  "name": "Unapproved AI destination",
  "description": "Block endpoint access to an unapproved AI service.",
  "enabled": true,
  "acknowledgeBroadScope": true,
  "appliesTo": {},
  "enforcementSurfaces": ["endpoint_route"],
  "conditions": {
    "field": "destination.domain",
    "op": "eq",
    "value": "ai.example.com"
  },
  "action": "block",
  "notification": {
    "message": "This AI destination is not approved for organization use.",
    "notifyUser": true
  }
}

Because the scope is organization-wide and the action is disruptive, acknowledgeBroadScope is required.

Account review

This Access policy records proven personal-account use for review without blocking the activity.

{
  "id": "personal-ai-account",
  "name": "Personal AI account",
  "enabled": true,
  "appliesTo": {},
  "enforcementSurfaces": ["endpoint_route"],
  "conditions": {
    "all": [
      {
        "field": "browser.account_state",
        "op": "eq",
        "value": "personal_account"
      },
      {
        "field": "browser.account_truth_state",
        "op": "eq",
        "value": "proven"
      }
    ]
  },
  "action": "flag_for_review",
  "severity": "high"
}

The second condition prevents the policy from treating hinted or inferred account metadata as proven.

Runtime quarantine

This Access policy blocks a selected runtime and authorizes quarantine after the block.

{
  "id": "untrusted-runtime",
  "name": "Untrusted AI runtime",
  "enabled": true,
  "acknowledgeBroadScope": true,
  "appliesTo": {},
  "enforcementSurfaces": ["endpoint_route"],
  "enforcedBy": ["CrowdStrike"],
  "conditions": {
    "all": [
      {
        "field": "process.id",
        "op": "eq",
        "value": "runtime-catalog-id"
      },
      {
        "field": "process.path",
        "op": "starts_with",
        "value": "/tmp/"
      }
    ]
  },
  "action": "block",
  "remediation": {
    "triggerPhase": "post_block_cleanup",
    "applyWhenClassification": "known_ai",
    "actions": [
      {
        "surface": "local_runtime",
        "action": "quarantineRuntime"
      }
    ]
  }
}

Forge derives the remediation target from the positive process.id condition. The selected enforcedBy integration must advertise support for quarantineRuntime on local_runtime.

Rego match

This is the logic.module for a Content policy that blocks a Shell tool call when its structured command targets a production path:

package forge.content

default tool_id := ""
tool_id := input.tool.id

default command := ""
command := input.tool.input.command

matched if {
  tool_id == "Shell"
  contains(command, "/production/")
}

match := {
  "matched": matched,
  "reasonCode": "production_shell_command",
}

The policy object still supplies appliesTo, evaluateOn: ["pre_tool"], and action: "block". Rego supplies only the match result.

Get started

Observe

Secure

Enable

Integrations

Resources

Tool approval

Result filtering

MCP control

Destination block

Account review

Runtime quarantine

Rego match

​Tool approval

​Result filtering

​MCP control

​Destination block

​Account review

​Runtime quarantine

​Rego match

Tool approval

Result filtering

MCP control

Destination block

Account review

Runtime quarantine

Rego match