Shared fields
Policy IDs must begin with a letter or number. Remaining characters may include
letters, numbers,
., _, :, @, /, and -. Deleting a policy retires
its ID permanently.
Content policy
Content policies govern prompts, agent tools, MCP calls, tool results, model responses, and classifications.
The
response checkpoint is available only when the routed API surface
provides a supported response adapter.
Content actions are allow, block, flag_for_review, redact, filter,
nudge, and require_approval.
Within users, groups, and serviceAccounts, any matching subject qualifies.
Configured agents and products are separate required dimensions: each
configured dimension must match, while values within that dimension are
alternatives. An empty Content scope is organization-wide.
Access policy
Access policies govern AI products, providers, destinations, processes, browsers, accounts, routes, and local models.
Access actions are
allow, block, flag_for_review, and
require_approval.
enforcementSurfaces accepts:
An empty Access scope is organization-wide. An enabled broad policy that
blocks, requires approval, or authorizes remediation must set
acknowledgeBroadScope: true.
Surface constraints
The Console validates these execution constraints in addition to the family
JSON Schema.
Notification fields
Metadata enums
useCases accepts Data Encryption, Public Exposure, Data Sprawl,
Organizational Access, Resilience, Runtime Safety, Credential Risk,
AI Model Governance, and Shadow AI.
complianceFrameworks accepts Security Basics, NIST, CIS, GDPR,
HIPAA, PCI DSS, SOC 2, and OWASP.
Resolution
Console and Terraform accept readable user emails, group names, product slugs, agent labels, and integration names. Forge resolves each selector to one canonical binding when the policy is written:- no match is an error;
- an ambiguous match is an error;
- duplicate directory names can be qualified with a directory identifier;
- renaming an object does not silently retarget an existing revision.
Evaluation
1
Load policies
Forge loads enabled policies for the requested family and control surface.
2
Apply scope
Policies outside their identity, asset, checkpoint, or enforcement-surface
scope are skipped.
3
Evaluate logic
Forge evaluates the native condition tree or the compiled Rego
match
entrypoint.4
Apply exceptions
A matching
except tree suppresses the hit and records an exclusion
diagnostic.5
Combine hits
Forge retains every hit and selects the strongest compatible action.