> ## Documentation Index
> Fetch the complete documentation index at: https://docs.forge.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Examples

> Complete Content and Access policy definitions using supported fields and actions.

The definitions below use the same schemas as the Forge Console, API, and
Terraform provider. Replace example identifiers with values resolved from your
own Forge organization.

## Tool approval

This Content policy pauses a selected tool before execution and creates an
administrator approval request.

```json theme={"system"}
{
  "id": "restricted-tool-approval",
  "name": "Restricted tool approval",
  "description": "Require approval before a high-risk tool executes.",
  "rationale": "Place a human decision between an agent and a destructive capability.",
  "enabled": true,
  "appliesTo": {
    "groups": ["Engineering"]
  },
  "evaluateOn": ["pre_tool"],
  "conditions": {
    "field": "tool.id",
    "op": "eq",
    "value": "Shell"
  },
  "action": "require_approval",
  "approval": {
    "autoApproveOnRequest": false
  },
  "message": "This tool requires approval before it can run."
}
```

`require_approval` requires exactly `evaluateOn: ["pre_tool"]`. The group name
is resolved to a canonical directory binding when the policy is saved.

## Result filtering

This Content policy removes objects classified as sensitive from a structured
tool-result array.

```json theme={"system"}
{
  "id": "sensitive-result-filter",
  "name": "Sensitive result filter",
  "enabled": true,
  "appliesTo": {},
  "evaluateOn": ["post_tool"],
  "conditions": {
    "field": "tool.result",
    "op": "exists"
  },
  "action": "filter",
  "filter": {
    "collectionPath": "$.rows",
    "removeWhere": {
      "path": "$.classification",
      "op": "eq",
      "value": "sensitive"
    },
    "onUnavailable": "block"
  }
}
```

The policy acts only on tool results whose root contains a `rows` array.
`onUnavailable: "block"` prevents the original unfiltered result from
continuing if the expected structure is absent.

## MCP control

This Content policy blocks one MCP tool for a selected group.

```json theme={"system"}
{
  "id": "block-destructive-mcp-tool",
  "name": "Block destructive MCP tool",
  "enabled": true,
  "appliesTo": {
    "groups": ["Contractors"]
  },
  "evaluateOn": ["pre_tool"],
  "conditions": {
    "all": [
      {
        "field": "mcp.server_id",
        "op": "eq",
        "value": "registry-server-id"
      },
      {
        "field": "mcp.tool_id",
        "op": "eq",
        "value": "registry-tool-id"
      }
    ]
  },
  "action": "block",
  "message": "This MCP tool is not available to your group."
}
```

Use the stable Registry IDs supplied by Forge. A tool condition must identify
exactly one parent MCP server.

## Destination block

This Access policy blocks an AI destination at the endpoint route and provides
a user-facing notification.

```json theme={"system"}
{
  "id": "unapproved-ai-destination",
  "name": "Unapproved AI destination",
  "description": "Block endpoint access to an unapproved AI service.",
  "enabled": true,
  "acknowledgeBroadScope": true,
  "appliesTo": {},
  "enforcementSurfaces": ["endpoint_route"],
  "conditions": {
    "field": "destination.domain",
    "op": "eq",
    "value": "ai.example.com"
  },
  "action": "block",
  "notification": {
    "message": "This AI destination is not approved for organization use.",
    "notifyUser": true
  }
}
```

Because the scope is organization-wide and the action is disruptive,
`acknowledgeBroadScope` is required.

## Account review

This Access policy records proven personal-account use for review without
blocking the activity.

```json theme={"system"}
{
  "id": "personal-ai-account",
  "name": "Personal AI account",
  "enabled": true,
  "appliesTo": {},
  "enforcementSurfaces": ["endpoint_route"],
  "conditions": {
    "all": [
      {
        "field": "browser.account_state",
        "op": "eq",
        "value": "personal_account"
      },
      {
        "field": "browser.account_truth_state",
        "op": "eq",
        "value": "proven"
      }
    ]
  },
  "action": "flag_for_review",
  "severity": "high"
}
```

The second condition prevents the policy from treating hinted or inferred
account metadata as proven.

## Runtime quarantine

This Access policy blocks a selected runtime and authorizes quarantine after
the block.

```json theme={"system"}
{
  "id": "untrusted-runtime",
  "name": "Untrusted AI runtime",
  "enabled": true,
  "acknowledgeBroadScope": true,
  "appliesTo": {},
  "enforcementSurfaces": ["endpoint_route"],
  "enforcedBy": ["CrowdStrike"],
  "conditions": {
    "all": [
      {
        "field": "process.id",
        "op": "eq",
        "value": "runtime-catalog-id"
      },
      {
        "field": "process.path",
        "op": "starts_with",
        "value": "/tmp/"
      }
    ]
  },
  "action": "block",
  "remediation": {
    "triggerPhase": "post_block_cleanup",
    "applyWhenClassification": "known_ai",
    "actions": [
      {
        "surface": "local_runtime",
        "action": "quarantineRuntime"
      }
    ]
  }
}
```

Forge derives the remediation target from the positive `process.id` condition.
The selected `enforcedBy` integration must advertise support for
`quarantineRuntime` on `local_runtime`.

## Rego match

This is the `logic.module` for a Content policy that blocks a Shell tool call
when its structured command targets a production path:

```rego theme={"system"}
package forge.content

default tool_id := ""
tool_id := input.tool.id

default command := ""
command := input.tool.input.command

matched if {
  tool_id == "Shell"
  contains(command, "/production/")
}

match := {
  "matched": matched,
  "reasonCode": "production_shell_command",
}
```

The policy object still supplies `appliesTo`, `evaluateOn: ["pre_tool"]`, and
`action: "block"`. Rego supplies only the match result.