Create Policy

The Create Policy feature allows you to define governance policies that monitor and control AI agent interactions. Policies help ensure that agent behavior complies with organizational standards, regulatory requirements, and operational guidelines.

A policy evaluates agent inputs and outputs against configured detection rules. When a policy violation is identified, the configured enforcement action is automatically applied.

The policy creation process is guided through a step-by-step wizard, allowing you to configure policy details, detection rules, enforcement settings, and review the configuration before creating the policy.

Benefits of Using Policies

Policies help organizations maintain a consistent governance framework across AI agent interactions.

• Apply governance controls across AI agent interactions.
• Detect sensitive, restricted, or regulated information.
• Automatically enforce predefined actions when violations occur.
• Monitor policy evaluations and enforcement events.
• Support compliance audits and investigations.
• Maintain consistent governance across agents, projects, and environments.

Policy Creation Workflow

The policy creation process consists of four sequential steps. Complete each step before proceeding to the next. Successfully completed steps are indicated by a green check mark in the progress indicator.

Step	Name	Description
1	Basics	Define the policy identity, category, applicable country, and description.
2	Detection	Configure the rules and patterns used to identify policy violations.
3	Enforcement	Define how the system responds when a policy violation is detected.
4	Review	Review the configured settings before creating the policy.

Step 1 - Basics

The Basics step defines the identity and scope of the policy. The information provided here helps identify the policy and determines where it will be applied.

Fields

Field	Description
Policy Key	Enter a unique identifier for the policy. The key should clearly describe the policy and is typically written in uppercase using underscores (for example, PII_EMAIL_MASK).
Category	Select the category that best represents the policy, such as Data Security & Privacy.
Country	Select the country or region where the policy should be enforced.
Description	Provide a brief description explaining the purpose of the policy and what it detects.

Example

Field	Example Value
Policy Key	PII_PHONE_REDACT
Category	Data Security & Privacy
Country	United States
Description	Detects and masks phone numbers shared during agent interactions.

Step 2 - Detection

The Detection step defines the rules used to identify policy violations. Detection rules specify the content or patterns the policy evaluates during agent interactions.

Fields

Field	Description
Pattern Type	Specifies the detection method used by the policy. Currently, Regex is the supported pattern type.
Regex Patterns	One or more regular expressions used to identify policy violations.

Example

Field	Example Value
Pattern Type	Regex
Regex Pattern	\b(\+?\d{1,3}[-\s]?)?\d{10}\b

Sample Detection

Field	Value
Input	You can reach me at 9876543210.
Matched Value	9876543210

The detected value matches the configured regular expression, causing the policy to execute the configured enforcement action.

Step 3 - Enforcement

The Enforcement step defines how the system responds when a policy violation is detected. It also determines whether the policy is evaluated against agent input, output, or both.

Enforcement Fields

Field	Description
Action	Specifies the action performed when a policy violation is detected.
Direction	Determines whether the policy is applied to Input, Output, or Both.
Enabled	Determines whether the policy is active and available for enforcement.

Enforcement Actions

Action	Description	Example
REDACT	Masks or removes sensitive information before the response is returned.	Input: "My phone number is 9876543210" → Output: "My phone number is **********"
BLOCK	Prevents the response from being returned when a policy violation is detected.	Restricted content is detected and the response is blocked.
ALERT	Generates a notification for review without modifying or blocking the content.	Sensitive information is detected and logged for compliance review.

Step 4 - Review

The Review step displays a summary of the policy configuration before the policy is created. Review all configured values to verify that the policy behaves as intended.

Review Summary

The following information is displayed for verification:

• Policy Key
• Category
• Country
• Description
• Enabled Status
• Regex Patterns
• Keywords
• Enforcement Action
• Direction

Create Policy

After reviewing the configuration, click Create Policy to create the policy and make it available for governance monitoring and enforcement.

Note:

After a policy is created, it becomes available for governance monitoring, compliance evaluation, and enforcement according to its configured settings.

Post-Creation Actions

After creating a policy, you can continue managing policies or start a new policy creation workflow based on your requirements.

Action	Description
Return to Governance	Returns to the Governance dashboard where existing policies can be viewed and managed.
Create Another Policy	Starts a new policy creation workflow after the current policy is created.