Policies

Rules that decide allow, gate, or deny.

Risk tiers are the floor: HIGH-risk tools gate by default. Policies go further, spend caps, auto-approval thresholds, rate limits, and time windows, evaluated top to bottom by priority. The first rule that matches wins; if none match, the risk tier decides.

Active policies0 rules
No policies yet. The risk tiers still apply, HIGH-risk tools gate on their own. Add a rule below to go further.
New policy
Start from an example:
refund > $500 → require approval refund ≤ $100 → auto-run 3+ refunds in a run → deny deploys after 18:00 UTC → gate any HIGH tool → deny
Special fields: __count__ (times this tool ran in the run), __hour__ (0–23 UTC), __weekday__ (0=Mon), __risk__ (LOW/MED/HIGH). Any other field reads the tool’s arguments.