Policy Configuration

Policies define the conditions under which alerts are generated. Five built-in policy types are available out of the box.

Allowlists are deny-by-default

An empty allowlist does not disable a policy — it alerts on everything. An enabled unknown_agent policy with an empty allowed_agents list raises an alert for every AI agent it detects, and an enabled unauthorized_api policy with an empty allowed_domains list raises one for every API connection.

Fill the allowlist before enabling the policy, or disable the policy until you have one.

Policy structure

{
  "id": 1,
  "type": "unknown_agent",
  "name": "Unknown AI Agent Detected",
  "description": "Alert when an unapproved AI agent is running",
  "severity": "high",
  "enabled": true,
  "config": {
    "allowed_agents": ["claude-code", "cursor"]
  }
}

Field	Type	Description
type	string	Policy type (see below)
name	string	Display name
description	string	Human-readable description
severity	low|medium|high|critical	Alert severity
enabled	bool	Whether the policy is active
config	object	Type-specific configuration (see below)

Policy types

unknown_agent

Fires when an AI agent name is not in the allowed_agents list.

{
  "type": "unknown_agent",
  "config": {
    "allowed_agents": ["claude-code", "cursor", "copilot"]
  }
}

Empty list = alert on every agent

allowed_agents is deny-by-default. An empty list means no agent is allowed, so every detected agent produces an alert. The policy is only quiet once every sanctioned agent name is listed.

Automatic allowlist update

When an admin approves an agent in the Approval workflow, the agent's name is automatically added to allowed_agents. If no unknown_agent policy exists yet, one is created automatically with severity: high and enabled: true.

Agent names (canonical names used by adapters). Any name not on this list in your policy config counts as unknown, so include every tool your teams are allowed to use:

• claude-code
• cursor
• copilot
• amazon-q
• chatgpt
• gemini-cli
• windsurf
• openai-codex
• opencode

unauthorized_api

Fires when an agent connects to a domain not in the allowed_domains list.

{
  "type": "unauthorized_api",
  "config": {
    "allowed_domains": [
      "api.anthropic.com",
      "api.githubcopilot.com"
    ]
  }
}

Empty list = alert on every connection

allowed_domains is deny-by-default, exactly like allowed_agents. With an empty list every observed API connection produces an alert. This policy ships disabled for that reason — build the allowlist first, then enable it.

Common AI API domains:

• api.anthropic.com — Claude / Claude Code
• api.openai.com — OpenAI (ChatGPT, Codex CLI)
• api.githubcopilot.com — GitHub Copilot
• codewhisperer.us-east-1.amazonaws.com — Amazon Q Developer
• api.deepseek.com — DeepSeek
• generativelanguage.googleapis.com — Google Gemini
• api.mistral.ai — Mistral
• api.groq.com — Groq
• api.x.ai — xAI Grok
• api.cohere.ai — Cohere
• api.together.xyz — Together AI
• api.perplexity.ai — Perplexity

mcp_filesystem

Fires when a detected MCP server exposes filesystem tools (read_file, write_file, list_directory, etc.).

{
  "type": "mcp_filesystem",
  "config": {}
}

No configuration required. The policy uses built-in heuristics to identify filesystem-related MCP tools.

new_mcp_server

Fires the first time a specific MCP server is detected on an endpoint. Uses existing alerts as the "known servers" list — once an alert is acknowledged, the server is considered known.

{
  "type": "new_mcp_server",
  "config": {}
}

agent_offline

Fires when an enrolled endpoint stops checking in. This is the policy behind the offline alerts you see when a workstation is shut down, loses network access, or the agent service stops.

{
  "type": "agent_offline",
  "config": {}
}

Every tenant gets this policy automatically, at severity: critical and enabled. The offline threshold is configured centrally in Settings, not per policy.

Alert deduplication

Alerts are deduplicated to prevent alert floods: an open alert for the same condition persists until it is resolved. Once resolved, the same condition will trigger a new alert on the next scan.

Default seeded policies

Type	Severity	Enabled by default	Note
unknown_agent	high	✅	Ships with an empty allowlist, so it alerts on every agent until you add your sanctioned tools
unauthorized_api	high	❌	Disabled precisely because an empty allowlist would alert on every connection
mcp_filesystem	medium	✅
new_mcp_server	low	✅
agent_offline	critical	✅	Provisioned automatically for every tenant

Policy templates

Instead of building policies one by one, you can apply a template — a curated bundle that creates policies, firewall domain rules, and tool-permission rules in one step. Open Policies in the dashboard and choose a template from the gallery.

Template	What it does
Monitoring-Only Starter	Low-severity detection across all AI activity, zero blocking. See what is happening before you enforce anything.
Approved Agents Only	Alerts on any agent outside your approved list, pre-filled for Claude Code and Cursor, plus matching tool-permission rules.
Block Public AI APIs	Blocks the major public LLM API domains at the network level and alerts on unauthorized API connections.
MCP Filesystem Lockdown	Alerts whenever an MCP server touches the filesystem or a new MCP server appears.
Strict High-Security	Maximum coverage at high/critical severity: unknown agents, public AI APIs blocked, MCP filesystem locked down. Intended for regulated environments.

Applying a template is additive and atomic: everything in the bundle is created together, and you can edit or delete each resulting policy afterwards like any manually created one. Policies created from a template remain marked with their source template.

Start with Monitoring-Only

Applying Monitoring-Only Starter first gives you a week of real data without blocking anything. Move to Approved Agents Only or Block Public AI APIs once you know which tools and domains are actually in use.