Configure policies

Start with one measurable check

Use Security → Policies to create an enabled policy. For a model-independent first test, select Secrets Detection. Give it a recognizable name, choose its agent scope, and select Warning or Blocking.

Avoid beginning with every detector enabled. Model-backed checks can be unavailable, and an unrelated blocking policy can prevent a request while you are testing another rule.

Scope and configuration

A policy applies either to the selected agents or to all agents in its organization. Make sure the application's agent_name resolves to the intended agent. Each provider guide lists the actual configuration keys; adding an unknown JSON field does not establish that the detector honors it.

Browse all 16 policy types. Configuration-dependent template policies may start disabled until topics, competitors, tool access, or other prerequisites are supplied.

Warning to blocking

1. Evaluate a safe synthetic message and confirm a complete evaluation.
2. Evaluate Demo-only internal password is DEMO-ONLY-NEVER-USE. with the scoped Secrets policy in Warning mode.
3. Inspect the finding. A warning decision can still be allowed: true.
4. Edit the same policy to Blocking and save the new version.
5. Repeat with SDK decision caching disabled. Confirm allowed: false and verify the application stops the protected operation.

The same text alone is not a complete acceptance test. Include your own benign and adversarial examples and inspect incomplete checks separately.

Versioned evidence

Keep the returned policy_versions with your test record. A new policy version affects future evaluations; historical traces still describe their original execution. Explicit ad-hoc policies requests do not provide the same configured-policy version relationship.

Templates

Templates are starting configurations, not certifications. Review each rule and agent scope before applying. Reapplying a template preserves existing scoped policy edits rather than silently replacing them. See template scope.

Roll out deliberately

Choose the integration's transport failure behavior, required completion behavior, and output/tool boundaries before enabling blocking in a production workflow. A dashboard policy is effective only where your integration enforces its returned decision.