Shared fields
Policy IDs must begin with a letter or number. Remaining characters may include
letters, numbers,
., _, :, @, /, and -. Deleting a policy retires
its ID permanently.
Content policy
Content policies govern prompts, agent tools, MCP calls, tool results, model responses, and classifications.
The
response checkpoint is available only when the routed API surface
provides a supported response adapter.
Content actions are allow, block, flag_for_review, redact, filter,
nudge, and require_approval.
Within users, groups, and serviceAccounts, any matching subject qualifies.
Configured agents and products are separate required dimensions: each
configured dimension must match, while values within that dimension are
alternatives. An empty Content scope is organization-wide.
Access policy
Access policies govern AI products, providers, destinations, processes, browsers, accounts, routes, and local models.
Access actions are
allow, block, flag_for_review, and
require_approval.
enforcementSurfaces accepts:
An empty Access scope is organization-wide. An enabled broad policy that
blocks, requires approval, or authorizes remediation must set
acknowledgeBroadScope: true.
Surface constraints
The Console validates these execution constraints in addition to the family
JSON Schema.
Notification fields
Resource policy
Resource Policies govern configured Resource connections, HTTP requests, PostgreSQL and MySQL commands and results, and Redis commands. They do not expose AI product, provider, prompt, tool, MCP, or agent-session fields. They may use a proven calling process. Resource is a peer authoring family, not an Access surface or a smaller policy model. It uses the shared condition tree and operators, outcome combination, messages, named exceptions, revisions, Rego, backtests, and management authority. Its protocol field catalog and executable actions are independently capability checked. Its native conditions include prior-event, event-sequence, event-count, and distinct-value forms over bounded facts from the same authenticated Resource connection. They do not aggregate activity across connections or provide an organization-wide rate limit.
Resource actions are
allow, flag_for_review, block, redact, filter,
and require_approval. Resource Policies
do not store evaluateOn: the referenced condition fields determine whether
Forge evaluates before connection, for each HTTP request, or before each
database or Redis command. dataTarget identifies transformation data; it is
not an authored stage.
An empty Resource scope applies throughout the organization. Users, groups,
and service accounts form one subject dimension. Configured devices and
Resources are separate required dimensions; values within each dimension are
alternatives.
The editor and API validate protocol capabilities for every selected Resource.
An HTTP-only condition cannot be saved for a selected database Resource, and a
database- or Redis-only condition cannot be saved for a selected HTTP Resource.
The same validation applies to native conditions and forge.resource Rego.
HTTP request bodies support redaction. HTTP response bodies, PostgreSQL results,
and MySQL results support redaction and filtering. Database redaction requires paths,
which the Console presents as exact column names. Database filtering requires
collectionPath: "$.rows"; its predicate path selects a column from each row.
Approval has no dataTarget and cannot use conditions that require
post-operation data.
Metadata enums
useCases accepts Data Encryption, Public Exposure, Data Sprawl,
Organizational Access, Resilience, Runtime Safety, Credential Risk,
AI Model Governance, and Shadow AI.
complianceFrameworks accepts Security Basics, NIST, CIS, GDPR,
HIPAA, PCI DSS, SOC 2, and OWASP.
Resolution
Console and Terraform accept readable user emails, group names, product slugs, agent labels, and integration names. Forge resolves each selector to one exact binding when the policy is written:- no match is an error;
- an ambiguous match is an error;
- duplicate directory names can be qualified with a directory identifier;
- renaming an object does not silently retarget an existing revision.
Evaluation
1
Load policies
Forge loads enabled policies for the requested family and control surface.
2
Apply scope
Policies outside their identity, asset, checkpoint, or enforcement-surface
scope are skipped.
3
Evaluate logic
Forge evaluates the native condition tree or the compiled Rego
match
entrypoint.4
Apply exceptions
A matching
except tree suppresses the hit and records an exclusion
diagnostic.5
Combine hits
Forge retains every hit and selects the strongest compatible action.