Apply a policy to an agent
A policy does nothing until an agent carries it. Attachment is per agent, and both agent types support it.
Before you start
The policy must be published. Both pickers list active policies only — a draft won’t appear. See Publish & versions.
On an AI Agent
Open the LLM Settings tab
In the AI Agent builder, go to the LLM Settings tab and scroll to the LLM Policy section. With nothing attached it reads “No LLM policy applied”.
Add the policy
Click Add Policy and choose one from the list. You can also create a new policy from here without leaving the builder.
Save the agent
This step is required. Choosing a policy updates the builder, not the agent — a toast confirms “LLM Policy selected - save to apply”. Save the agent and the attachment is stored.
An unsaved selection looks identical to a saved one. The policy card renders, its rules are listed, and the agent runs with no policy at all. If a policy appears to do nothing, this is the first thing to check.
On a Task Agent
Open the overview panel
In the Task Agent builder, the overview panel has a Policy selector alongside the LLM model.
Choose a policy
Pick from the list of active policies. This saves immediately — a toast confirms “Policy updated”. There’s no separate save step here.
The policy applies to every node in the graph that calls a model — Quick Prompt, code nodes that use the LLM SDK, and tool-calling nodes. There’s no per-node policy; the agent’s policy governs all of them.
Reading the summary
Once attached, both surfaces show the same summary of what the policy actually enforces:
| Row | Shown when |
|---|---|
| PII Detection | Detection is on — the badge names the action |
| Allowed Topics / Blocked Topics | Topics are set — the first three, then a count |
| Blocked Content | A count of blocked keywords, patterns and exact strings combined |
| Active Content | Removal is on |
| Response Cache | Only when explicitly disabled |
A policy with no rules says so, and notes that secret redaction still applies to every request regardless.
Blocked content shows as a count, not the terms themselves. To see or change them, open the policy in the wizard.
Removing a policy
Use Remove on the policy card (AI Agent) or clear the selector (Task Agent). The policy itself isn’t deleted — it’s detached from this agent, and can be reattached or used by others.
What attachment does not do
- It doesn’t cascade. If a Task Agent calls another agent, that agent runs under its own policy. A restrictive parent doesn’t constrain a permissive child.
- It isn’t project-wide. Other agents in the project are unaffected.
- It doesn’t apply to indexing. Adding documents to a Content Store or writing agent memory doesn’t pass through the agent’s policy.
Common issues
- The policy list is empty — no published policies exist for the project. Publish one.
- Attached but nothing is enforced — on an AI Agent, confirm you saved. Then confirm the agent actually calls a model: an AI Agent with no active skill never reaches one.
- You edited the policy and the agent didn’t change — edits take effect immediately, but the agent must still be attached to the policy you edited. See Publish & versions.
Next
- Publish & versions — the states a policy moves through.