Create a policy
Outcome
A policy saved as a draft, ready to publish and attach to an agent.
Before you start
- Developer Developer role or above.
- A rough idea of what you’re protecting against. The templates below are a decent starting point if you don’t.
Start from a template
Three templates come with the platform. Each is a starting point you can change — applying one fills the form in, it doesn’t lock anything.
| Template | What it sets up | Use when |
|---|---|---|
| HIPAA Strict | PII detection across the widest set of types, redaction, active-content removal, response caching off | Healthcare data, or anything where responses must never be reused |
| GDPR Compliant | PII detection focused on personal identifiers including IP addresses, redaction, active-content removal | Personal data of EU residents |
| Content Safe | Blocked topics covering violence, hate speech, harassment, self-harm and illegal activity, plus blocked strings for common credential patterns | Public-facing assistants |
Click From Template on the policies list, then pick one from the Quick Start Templates list in the wizard’s sidebar. The form fills in and you carry on editing.
Steps
Open the wizard
From Configuration → LLM Policies, click New Policy for a blank one, or From Template to start from one of the three above.
Step 1 — Basic Info
Give the policy a name and, ideally, a description. The name is what you’ll see in the agent’s policy picker, so make it say what the policy is for — Support Bot Guardrails beats Policy 2.
Step 2 — Content Policy
This is the substance of the policy. Four independent groups, each optional:
- PII detection — see PII detection
- Topic restrictions — see Topic restrictions
- Blocked keywords and patterns — see Blocked content
- Remove active content — see Remove active content
Leave a group untouched and it simply doesn’t apply.
Step 3 — Advanced
One control: the response cache. Leave it on unless this agent’s responses carry data that must not be retained.
Create it
Click Create Policy. The policy is saved as a draft.
A draft enforces nothing. It won’t appear in an agent’s policy picker until you publish it. See Publish & versions.
Moving between steps
The sidebar stepper lets you jump to any step at any time — you don’t have to go in order, and nothing is lost by moving back and forth. Next validates the current step before advancing.
Common issues
- A blocked pattern is rejected when you save — patterns are validated. There’s a limit of 50 patterns, 1000 characters each, and patterns with nested quantifiers are refused because they can hang the matcher. See Blocked content.
- You picked a template and fewer PII types are selected than you expected — types with no detector are dropped on apply. Only the types shown in the picker can actually be found.
- The policy doesn’t appear on your agent — it’s still a draft. Publish it.
Next
- Publish & versions — making the draft live.