Skip to main content
Create policies in Console → Policies. You need permission to manage policies for the organization or selected project.

1. Write the question

Select Create policy, enter a name, and write a yes-or-no question ending in a question mark. A description is optional. Name the behavior you want to identify and include any important exceptions. For example:
Does the response expose a reusable authentication credential, excluding redacted values, placeholders, and clearly fictional examples?
Create policy Rule tab with name, description, a sample yes-or-no question, and writing guidance

The Rule tab pairs the question editor with writing guidance.

See Policy-writing best practices for more examples.

2. Configure the policy

Under Settings, choose:
  1. Content: Requests, Responses, or both. A request policy checks input before the model runs. A response policy checks generated output, including tool calls. In Block mode, output is held until the check completes.
  2. Applies to: All projects, selected projects, or only when explicitly selected for a run.
  3. Enforcement: Start with Monitor to record matches without changing traffic. Choose Block when you’re ready to prevent matches from continuing.
  4. Sensitivity: Leave the default unless you have examples showing that a different value is needed. Lower values match more borderline cases.
Create policy Settings tab with Responses selected, All projects selected, Monitor mode, and 70 percent sensitivity

The Settings tab controls what is checked, where the policy applies, and what happens on a match.

Response policies in Block mode hold generated output until the check completes, so they add response latency. This also applies to streaming responses.

3. Save or publish

For a new policy, Save as draft keeps it inactive. For an existing published policy, saving a draft leaves the published version in effect. Publish policy activates the current settings according to their scope and mode. A policy set to Only when selected does not run automatically after publication; add it to a Playground run or select it on an API request. Test the policy in Playground, then inspect Decisions. Review matches and false positives before changing Monitor to Block. You can edit and republish a policy later. To stop an active policy without deleting it, select Pause on its detail page.
Last modified on September 30, 2026