Policy Overview

Policies are the rules that govern what AI agents can and cannot do. In TealTiger v1.3, policies are authored by governance teams, signed into bundles, and enforced deterministically at runtime.

What Is a Policy?

A policy is a rule that maps a condition to an action with an automation level:

- condition: { action: "file.delete", environment: "production" }
  automation: auto_deny
  reason_code: FILE_DELETE_BLOCKED

- condition: { action: "payment.*", amount: { gt: 100 } }
  automation: approval_required
  reason_code: HIGH_VALUE_PAYMENT

- condition: { action: "*.read" }
  automation: auto_allow

Every policy evaluation produces a deterministic Decision — same input + same policy = same decision, every time.

Policy Structure

Component	What It Does	Example
Condition	When this rule applies	`{ action: "file.delete" }`
Automation Level	What to do when matched	`auto_deny`, `approval_required`
Reason Code	Why the decision was made	`FILE_DELETE_BLOCKED`
Control ID	Which governance control	`SEC-001`, `NHI-003`

Automation Levels

Each rule specifies how the decision should be automated:

Level	Behavior	Use When
`auto_allow`	ALLOW immediately	Low-risk, read-only actions
`auto_deny`	DENY immediately	Forbidden actions, safety violations
`auto_sanitize`	MODIFY (sanitize content)	PII in output, secrets in logs
`approval_required`	PENDING (hold for human)	High-value actions, sensitive changes

FREEZE Rules

FREEZE rules are a special class of policy that cannot be overridden:

freeze_rules:
  - id: FREEZE-001
    condition: { action: "database.drop" }
    reason: FREEZE_DATABASE_DROP
  - id: FREEZE-002
    condition: { action: "governance.*.modify" }
    reason: FREEZE_GOVERNANCE_MODIFICATION

Properties:

Evaluated FIRST (before all other rules)
Cannot be modified, disabled, or removed by application code
Persist across policy hot-swaps
Log FREEZE_TAMPER_ATTEMPT on any modification attempt

See FREEZE Rules for details.

Policy Bundles

In enterprise deployments, policies are packaged into signed bundles:

// Governance team signs and publishes
// tealtiger-cli bundle sign --input ./policies/ --key governance.pem --output bundle.signed.json

// Development team loads at runtime
const engine = new TealEngine({
  bundle: await loadBundle('./governance/bundle.signed.json'),
  bundle_verification: { public_key: process.env.GOVERNANCE_PUBLIC_KEY, require_signature: true },
});

Bundles include: policy rules, FREEZE rules, NHI configuration, cost ceilings, and module settings. See Governance at Scale.

Quick Start Examples

Zero-Config (OWASP Pack)

import { TealEngine, OWASPPolicyPack } from 'tealtiger';

const engine = new TealEngine({
  policy: OWASPPolicyPack.default(),
  modules: OWASPPolicyPack.modules(),
  mode: 'ENFORCE',
});

Covers all 10 OWASP Agentic Security risks with production-ready defaults.

Custom Rules

const engine = new TealEngine({
  policy: {
    rules: [
      { condition: { action: 'file.delete' }, automation: 'auto_deny' },
      { condition: { action: 'payment.*', amount: { gt: 100 } }, automation: 'approval_required' },
      { condition: { action: '*.read' }, automation: 'auto_allow' },
    ],
  },
  freeze: [
    { id: 'FREEZE-001', condition: { action: 'database.drop' }, reason: 'FREEZE_DATABASE_DROP' },
  ],
  mode: 'ENFORCE',
});

Policy Evaluation Order

FREEZE rules — Checked first, short-circuit on match
NHI scope — Agent must have permission for the action
Temporal constraints — Session TTL, cooldowns, time-of-day
Policy rules — Matched in order, first match wins
Default — If no rule matches, action is ALLOW (configurable)

Next Steps

Policy Authoring Guide

Write custom policies with conditions and matchers

Reason Codes

All available reason codes and their meanings

OWASP Policy Pack

Pre-built zero-config governance

Configuration Reference

Full engine configuration options

Getting Started

Core Concepts

Governance Domains

Policy Authoring

Architecture

Integrations

Deployment

API Reference

Cookbook

Compliance & GRC

Guides

Reference

Versions

Playground

Dashboard

Blog

What Is a Policy?

Policy Structure

Automation Levels

FREEZE Rules

Policy Bundles

Quick Start Examples

Zero-Config (OWASP Pack)

Custom Rules

Policy Evaluation Order

Next Steps

Policy Authoring Guide

Reason Codes

OWASP Policy Pack

Configuration Reference

​What Is a Policy?

​Policy Structure

​Automation Levels

​FREEZE Rules

​Policy Bundles

​Quick Start Examples

​Zero-Config (OWASP Pack)

​Custom Rules

​Policy Evaluation Order

​Next Steps

Policy Authoring Guide

Reason Codes

OWASP Policy Pack

Configuration Reference

What Is a Policy?

Policy Structure

Automation Levels

FREEZE Rules

Policy Bundles

Quick Start Examples

Zero-Config (OWASP Pack)

Custom Rules

Policy Evaluation Order

Next Steps