> ## Documentation Index > Fetch the complete documentation index at: https://docs.forge.ai/llms.txt > Use this file to discover all available pages before exploring further. # Schema > Policy fields, family-specific configuration, scope, and evaluation sequence. Content and Access policies share an identity and match model, but expose different scope, runtime, and action fields. Unknown properties are rejected. ## Shared fields | Field | Required | Type | Meaning | | ---------------------- | -------- | ---------------------------- | --------------------------------------------------------------------------- | | `id` | Yes | identifier, 1–256 characters | Immutable policy identity used by APIs, revisions, approvals, and Terraform | | `name` | Yes | string | Mutable display name | | `description` | No | string | Human-readable summary | | `rationale` | No | string | Reason the control exists; does not affect evaluation | | `useCases` | No | unique string array, max 9 | Product classification metadata | | `complianceFrameworks` | No | unique string array, max 8 | Framework mapping metadata; does not independently establish compliance | | `labels` | No | unique string array, max 256 | Organization-defined search and grouping labels | | `enabled` | Yes | boolean | Whether the current revision participates in new evaluations | | `appliesTo` | Yes | scope object | Identities and assets eligible for evaluation | | `conditions` | One of | condition tree | Typed native match logic | | `logic` | One of | `RegoLogic` | Compiled `forge.rego.v1` match logic; mutually exclusive with `conditions` | | `except` | No | condition tree | Suppresses a hit when both the primary match and exception match | | `action` | Yes | family-specific enum | Consequence applied after a match | Policy IDs must begin with a letter or number. Remaining characters may include letters, numbers, `.`, `_`, `:`, `@`, `/`, and `-`. Deleting a policy retires its ID permanently. ## Content policy Content policies govern prompts, agent tools, MCP calls, tool results, model responses, and classifications. | Field | Required when | Type | Meaning | | -------------- | --------------------------- | --------------------------------------------------------------------- | ------------------------------------------------------------------ | | `appliesTo` | Always | `users`, `groups`, `serviceAccounts`, `agents`, and `products` arrays | Content scope | | `evaluateOn` | Always | 1–4 of `prompt`, `pre_tool`, `post_tool`, `response` | Checkpoints at which the policy runs | | `customFields` | No | array, max 256 | Registered typed fields beneath `tool.input` | | `approval` | `action = require_approval` | `{ "autoApproveOnRequest": boolean }` | Approval behavior; valid only at `pre_tool` | | `message` | No | string | Guidance returned by supported `block`, `nudge`, or approval paths | | `redaction` | `action = redact` | redaction object | Transformation strategy and optional structured paths | | `filter` | `action = filter` | filter object | Structured post-tool collection filtering | The `response` checkpoint is available only when the routed API surface provides a supported response adapter. Content actions are `allow`, `block`, `flag_for_review`, `redact`, `filter`, `nudge`, and `require_approval`. Within `users`, `groups`, and `serviceAccounts`, any matching subject qualifies. Configured `agents` and `products` are separate required dimensions: each configured dimension must match, while values within that dimension are alternatives. An empty Content scope is organization-wide. ## Access policy Access policies govern AI products, providers, destinations, processes, browsers, accounts, routes, and local models. | Field | Required when | Type | Meaning | | ----------------------- | --------------------------- | --------------------------------------- | --------------------------------------------------------------------- | | `appliesTo` | Always | `users`, `groups`, and `devices` arrays | Subject and device scope | | `enforcementSurfaces` | Always | 1–3 surface values | Where the access decision executes | | `enforcedBy` | No | integration identifiers | Limits execution to named capable integrations | | `severity` | No | `low`, `medium`, `high`, or `critical` | Risk severity attached to Access-policy decisions | | `runtime` | No | runtime configuration | Candidate handling, enhanced detection, timeout, and failure behavior | | `approval` | `action = require_approval` | object | How access is granted after a matching approval policy | | `remediation` | No | remediation configuration | Authorized response actions and execution phase | | `notification` | No | notification configuration | User/admin messages, acknowledgement, and exception-request behavior | | `acknowledgeBroadScope` | Broad disruptive policy | boolean | Required before enabling broad block, approval, or remediation | Access actions are `allow`, `block`, `flag_for_review`, and `require_approval`. `enforcementSurfaces` accepts: | Value | Execution boundary | | ---------------- | ------------------------------------------------------------------------------- | | `endpoint_route` | Endpoint or network-rerouted process, browser, API, or MCP activity | | `provider` | A control projected to one selected provider or network enforcement integration | An empty Access scope is organization-wide. An enabled broad policy that blocks, requires approval, or authorizes remediation must set `acknowledgeBroadScope: true`. ### Surface constraints | Surface | Supported authoring behavior | | ---------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `endpoint_route` | Native positive selector trees only; scalar fields use `eq`/`in`, collection fields use `contains`/`contains_any`; negation and Rego are not executable on this surface | | `provider` | Native positive `destination.domain` or `destination.ip` rules using `eq`/`in`; requires exactly one `enforcedBy`; no identity/device scope, exception, Rego, or remediation | The Console validates these execution constraints in addition to the family JSON Schema. ### Notification fields | Field | Values | | ------------------ | ----------------------------------------------------------------------- | | `message` | User-facing text | | `notifyUser` | boolean | | `adminAudience` | `security_admins`, `policy_owners`, `security_admins_and_policy_owners` | | `acknowledgement` | `mandatory_when_disruptive`, `not_required` | | `exceptionRequest` | `available_when_future_policy_blocks`, `disabled_for_future_blocks` | ## Metadata enums `useCases` accepts `Data Encryption`, `Public Exposure`, `Data Sprawl`, `Organizational Access`, `Resilience`, `Runtime Safety`, `Credential Risk`, `AI Model Governance`, and `Shadow AI`. `complianceFrameworks` accepts `Security Basics`, `NIST`, `CIS`, `GDPR`, `HIPAA`, `PCI DSS`, `SOC 2`, and `OWASP`. ## Resolution Console and Terraform accept readable user emails, group names, product slugs, agent labels, and integration names. Forge resolves each selector to one canonical binding when the policy is written: * no match is an error; * an ambiguous match is an error; * duplicate directory names can be qualified with a directory identifier; * renaming an object does not silently retarget an existing revision. ## Evaluation Forge loads enabled policies for the requested family and control surface. Policies outside their identity, asset, checkpoint, or enforcement-surface scope are skipped. Forge evaluates the native condition tree or the compiled Rego `match` entrypoint. A matching `except` tree suppresses the hit and records an exclusion diagnostic. Forge retains every hit and selects the strongest compatible action. The decision is deterministic for a policy revision, input document, and runtime/compiler version. See [Actions](/secure/actions) for precedence and family defaults.