Policies

Declarative inspection and enforcement rules scoped to traffic.

This screen belongs to the Secure deployment operator, not an ordinary hosted customer. Hosted customers have a separate account page with their own keys and limits; policy and service settings are not exposed there. Contact the operator to change protection. In the operator console, open the route listed above; a report tenant filter does not automatically scope a global setting.

Examples use educational data. Use your own authorized tenant in real integrations. Each screenshot shows the actual frontend, with the source and educational/demo mode stated below it.

Step-by-step actions

Policies → New policy: set unique id DOCS-EMAIL, name, status draft and your scope.tenant.
Add a real class rule, e.g. pii.email → mask, plus injection_detected → block.
Review JSON and Save policy; a draft does not enforce. Preview, where available in your version, does not activate a rule.
Before activation, test positive/negative samples and another tenant on staging.
Set active through the editor and reread the card; Pause temporarily excludes it.
Use Versions → Roll back to revert and recheck decisions.

Every control and its meaning

Control / parameter	Values, units and effect
id, name, owner, description	Unique id required; name, owner and description explain purpose without secrets. Edit the full document as JSON.
status	draft does not execute, active executes, paused is temporarily excluded. Pausing one policy leaves other protection intact.
scope.tenant / groups / apps	Nonempty groups/apps are rejected with 422 because trusted bindings are unavailable. A specific tenant limits enforcement; * covers every tenant. Report filters do not change scope.
rules[].when	data_class, min_severity, sensitivity, content_type, point, injection_detected and provider_unlisted define matching. Detailed settings explain all fields and compatibility. Boolean predicates accept true and false. Recheck compound predicates in JSON: supplied fields are combined with AND.
then / note	Action block/mask/reroute/flag/allow (UI may show blocked/masked/rerouted/flagged/allowed). Note explains a rule without affecting matching.
on_inspection_unavailable / block_message	fail_closed or empty; unavailable inspection blocks the request. block_message is user-facing and must contain no secrets. Fail-open is not a supported inspector recovery procedure.

Verify the result

Save and reread complete JSON on each replica, then compare a fresh request: request ID, action and policy_id/rule_id. The hosted release of 15 October 2026 reads shared PostgreSQL without manual reload. The active test policy must win; pausing leaves other rules active.

Errors, disabling and reverting changes

For 400/422, correct JSON, enums, scope or ranges while retaining the working policy. On older gateways, groups/apps do not prove isolation; have the operator verify the contract and runtime.

**Policy editor for a test tenant · actual staging**
2026-10-15 · Actual staging application and an existing operator session. Synthetic data or non-personal configuration only; credentials and the operator profile are excluded. A form alone does not establish persistence or replica consistency. The editor and scope warning were qualified on staging, then the frontend fix was released to hosted staging and production on 2026-10-15. Server replica consistency is a separate qualification.

**Policy editor: false and save · shared staging**
2026-10-15 · Actual shared staging with the recovered gateway and r8 editor. Synthetic policy restricted to an owned test tenant; profile and secrets excluded from the original capture. UI save and active/paused were independently checked on both replicas without reload. Original draft restored and temporary key revoked after qualification.

Detailed security settings · Traffic analysis · FAQ · All application sections