Examples

The definitions below use the same schemas as the Forge Console, API, and Terraform provider. Replace example identifiers with values resolved from your own Forge organization. Access, Content, and Resource are peer authoring families over the same policy engine. Examples differ in scope, fields, and capability-gated actions, not in their revision, exception, policy-as-code, backtest, or ownership model.

Tool approval

This Content policy pauses a selected tool before execution and creates an administrator approval request.

{
  "id": "restricted-tool-approval",
  "name": "Restricted tool approval",
  "description": "Require approval before a high-risk tool executes.",
  "rationale": "Place a human decision between an agent and a destructive capability.",
  "enabled": true,
  "appliesTo": {
    "groups": ["Engineering"]
  },
  "evaluateOn": ["pre_tool"],
  "conditions": {
    "field": "tool.id",
    "op": "eq",
    "value": "Shell"
  },
  "action": "require_approval",
  "approval": {
    "autoApproveOnRequest": false
  },
  "message": "This tool requires approval before it can run."
}

require_approval requires exactly evaluateOn: ["pre_tool"]. The group name is resolved to one exact directory binding when the policy is saved.

Result filtering

This Content policy removes objects classified as sensitive from a structured tool-result array.

{
  "id": "sensitive-result-filter",
  "name": "Sensitive result filter",
  "enabled": true,
  "appliesTo": {},
  "evaluateOn": ["post_tool"],
  "conditions": {
    "field": "tool.result",
    "op": "exists"
  },
  "action": "filter",
  "filter": {
    "collectionPath": "$.rows",
    "removeWhere": {
      "path": "$.classification",
      "op": "eq",
      "value": "sensitive"
    },
    "onUnavailable": "block"
  }
}

The policy acts only on tool results whose root contains a rows array. onUnavailable: "block" prevents the original unfiltered result from continuing if the expected structure is absent.

MCP control

This Content policy blocks one MCP tool for a selected group.

{
  "id": "block-destructive-mcp-tool",
  "name": "Block destructive MCP tool",
  "enabled": true,
  "appliesTo": {
    "groups": ["Contractors"]
  },
  "evaluateOn": ["pre_tool"],
  "conditions": {
    "all": [
      {
        "field": "mcp.server_id",
        "op": "eq",
        "value": "registry-server-id"
      },
      {
        "field": "mcp.tool_id",
        "op": "eq",
        "value": "registry-tool-id"
      }
    ]
  },
  "action": "block",
  "message": "This MCP tool is not available to your group."
}

Use the stable Registry IDs supplied by Forge. A tool condition must identify exactly one parent MCP server.

Destination block

This Access policy blocks an AI destination at the endpoint route and provides a user-facing notification.

{
  "id": "unapproved-ai-destination",
  "name": "Unapproved AI destination",
  "description": "Block endpoint access to an unapproved AI service.",
  "enabled": true,
  "acknowledgeBroadScope": true,
  "appliesTo": {},
  "enforcementSurfaces": ["endpoint_route"],
  "conditions": {
    "field": "destination.domain",
    "op": "eq",
    "value": "ai.example.com"
  },
  "action": "block",
  "notification": {
    "message": "This AI destination is not approved for organization use.",
    "notifyUser": true
  }
}

Because the scope is organization-wide and the action is disruptive, acknowledgeBroadScope is required.

Account review

This Access policy records proven personal-account use for review without blocking the activity.

{
  "id": "personal-ai-account",
  "name": "Personal AI account",
  "enabled": true,
  "appliesTo": {},
  "enforcementSurfaces": ["endpoint_route"],
  "conditions": {
    "all": [
      {
        "field": "browser.account_state",
        "op": "eq",
        "value": "personal_account"
      },
      {
        "field": "browser.account_truth_state",
        "op": "eq",
        "value": "proven"
      }
    ]
  },
  "action": "flag_for_review",
  "severity": "high"
}

The second condition prevents the policy from treating hinted or inferred account metadata as proven.

Runtime quarantine

This Access policy blocks a selected runtime and authorizes quarantine after the block.

{
  "id": "untrusted-runtime",
  "name": "Untrusted AI runtime",
  "enabled": true,
  "acknowledgeBroadScope": true,
  "appliesTo": {},
  "enforcementSurfaces": ["endpoint_route"],
  "enforcedBy": ["CrowdStrike"],
  "conditions": {
    "all": [
      {
        "field": "process.id",
        "op": "eq",
        "value": "runtime-catalog-id"
      },
      {
        "field": "process.path",
        "op": "starts_with",
        "value": "/tmp/"
      }
    ]
  },
  "action": "block",
  "remediation": {
    "triggerPhase": "post_block_cleanup",
    "applyWhenClassification": "known_ai",
    "actions": [
      {
        "surface": "local_runtime",
        "action": "quarantineRuntime"
      }
    ]
  }
}

Forge derives the remediation target from the positive process.id condition. The selected enforcedBy integration must advertise support for quarantineRuntime on local_runtime.

Rego match

This is the logic.module for a Content policy that blocks a Shell tool call when its structured command targets a production path:

package forge.content

default tool_id := ""
tool_id := input.tool.id

default command := ""
command := input.tool.input.command

matched if {
  tool_id == "Shell"
  contains(command, "/production/")
}

match := {
  "matched": matched,
  "reasonCode": "production_shell_command",
}

The policy object still supplies appliesTo, evaluateOn: ["pre_tool"], and action: "block". Rego supplies only the match result.

Block PostgreSQL deletes

This Resource Policy stops a DELETE command before it reaches one production database and returns a useful message to the database client.

{
  "id": "production-database-deletes",
  "name": "Protect production database writes",
  "description": "Require the approved workflow for destructive database changes.",
  "enabled": true,
  "appliesTo": {
    "users": [],
    "groups": [],
    "serviceAccounts": [],
    "devices": [],
    "resources": ["res_production_database"]
  },
  "enforcement": "enforce",
  "action": "block",
  "message": "Use the approved change workflow for production writes.",
  "conditions": {
    "field": "request.postgres.command",
    "op": "eq",
    "value": "DELETE"
  }
}

To observe the same matches before enforcement, set enforcement to monitor. Keep enabled true so the policy participates in evaluation. The effective operation remains allowed while Resource Activity records that the policy would have blocked it.

Redact an HTTP request body

This Resource Policy replaces selected JSON values before the request reaches the destination. The body itself is never a condition input or retained evidence.

{
  "id": "redact-http-customer-data",
  "name": "Remove customer data from API writes",
  "enabled": true,
  "appliesTo": { "resources": ["res_customer_api"] },
  "enforcement": "enforce",
  "conditions": {
    "all": [
      { "field": "request.http.method", "op": "eq", "value": "POST" },
      {
        "field": "request.http.path",
        "op": "starts_with",
        "value": "/v1/events"
      }
    ]
  },
  "action": "redact",
  "dataTarget": "http_request_body",
  "redaction": {
    "strategy": "constant",
    "replacement": "[REDACTED]",
    "paths": ["$.customer.email", "$.customer.phone"]
  }
}

The request must contain one complete, uncompressed JSON value no larger than 32 KiB. If an enforcing policy matches and Forge cannot safely transform the body, the request is blocked before forwarding.

Filter an HTTP response

{
  "id": "filter-restricted-records",
  "name": "Remove restricted API records",
  "enabled": true,
  "appliesTo": { "resources": ["res_customer_api"] },
  "conditions": {
    "field": "request.http.path",
    "op": "eq",
    "value": "/v1/records"
  },
  "action": "filter",
  "dataTarget": "http_response_body",
  "filter": {
    "collectionPath": "$.records",
    "removeWhere": {
      "path": "$.classification",
      "op": "eq",
      "value": "restricted"
    },
    "onUnavailable": "block"
  }
}

Redact PostgreSQL result columns

{
  "id": "mask-payment-cards",
  "name": "Mask payment cards in query results",
  "enabled": true,
  "appliesTo": { "resources": ["res_production_database"] },
  "conditions": {
    "field": "request.postgres.tables",
    "op": "contains",
    "value": "payments"
  },
  "action": "redact",
  "dataTarget": "postgres_result",
  "redaction": {
    "strategy": "partial",
    "keepEnd": 4,
    "paths": ["$.payment_card"]
  }
}

PostgreSQL filtering uses the same filter object with dataTarget: "postgres_result", collectionPath: "$.rows", and a removeWhere.path naming an exact column.

Require approval for a PostgreSQL command

{
  "id": "approve-production-deletes",
  "name": "Approve production deletes",
  "enabled": true,
  "appliesTo": { "resources": ["res_production_database"] },
  "conditions": {
    "field": "request.postgres.command",
    "op": "eq",
    "value": "DELETE"
  },
  "action": "require_approval",
  "approval": { "mode": "admin_approval" },
  "message": "A database owner must approve this production change."
}

The first command is rejected with an approval reference. Approval creates a ten-minute, one-use grant; the same caller must retry the identical command.

Resource Rego match

Rego can select a request using Resource metadata while the typed policy configuration owns the transformation:

package forge.resource

match := {
  "matched": input.request.http.method == "POST" &&
    startswith(input.request.http.path, "/v1/events"),
  "reasonCode": "customer_event_write",
}

The surrounding Resource Policy sets action: "redact", dataTarget: "http_request_body", and redaction. Rego cannot read the body, emit transformation instructions, or create an approval grant.

Get started

Observe

Secure

Enable

Integrations

Resources

Tool approval

Result filtering

MCP control

Destination block

Account review

Runtime quarantine

Rego match

Block PostgreSQL deletes

Redact an HTTP request body

Filter an HTTP response

Redact PostgreSQL result columns

Require approval for a PostgreSQL command

Resource Rego match

​Tool approval

​Result filtering

​MCP control

​Destination block

​Account review

​Runtime quarantine

​Rego match

​Block PostgreSQL deletes

​Redact an HTTP request body

​Filter an HTTP response

​Redact PostgreSQL result columns

​Require approval for a PostgreSQL command

​Resource Rego match

Tool approval

Result filtering

MCP control

Destination block

Account review

Runtime quarantine

Rego match

Block PostgreSQL deletes

Redact an HTTP request body

Filter an HTTP response

Redact PostgreSQL result columns

Require approval for a PostgreSQL command

Resource Rego match