Govern with Policies

AuthSpoke's policy engine is explainable and default-deny. Every decision names the policy that produced it. Policies are versioned, tenant-scoped and evaluated server-side, ordered by priority (lower = evaluated first). The first matching enabled policy wins; if nothing matches, the answer is DENY.

1. Author a policy#

A policy targets a scopeType (AGENT / TOOL / MODEL / MCP / DATA / GLOBAL), an optional scopeId (a specific target), and an optional action. Its effect is ALLOW or DENY.

curl -X POST "https://your-company.authspoke.com/api/v1/ai/policies" \
  -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
  -d '{
    "name": "Block unapproved models",
    "description": "Only approved, US/EU-resident models may be used.",
    "effect": "DENY",
    "scopeType": "MODEL",
    "action": "USE_MODEL",
    "priority": 10,
    "enabled": true
  }'

Creating a DENY policy emits a WARNING-severity event; ALLOW emits INFO.

2. Order matters — set priority deliberately#

Lower priority is evaluated first, so put your hard denials at the top:

# Broad allow for governed MCP access, but lower precedence (evaluated later)
curl -X POST "https://your-company.authspoke.com/api/v1/ai/policies" \
  -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
  -d '{ "name":"Allow approved MCP access", "effect":"ALLOW", "scopeType":"MCP", "action":"ACCESS_MCP", "priority":50, "enabled":true }'

3. Evaluate a decision#

Ask the engine what it would decide for a given scope + action. This is what a runtime enforcement point (or your own gateway) calls:

curl -X POST "https://your-company.authspoke.com/api/v1/ai/policies/evaluate" \
  -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
  -d '{ "scopeType":"MODEL", "action":"USE_MODEL" }'

{
  "decision": "DENY",
  "reason": "Matched policy “Block unapproved models” (priority 10)",
  "policyId": "…"
}

An unmatched scope returns the default:

{ "decision": "DENY", "reason": "No matching policy — default deny", "policyId": null }

4. Update & version#

Editing a policy bumps its version automatically:

curl -X PUT "https://your-company.authspoke.com/api/v1/ai/policies/$POLICY_ID" \
  -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
  -d '{ "name":"Block unapproved models", "effect":"DENY", "scopeType":"MODEL", "action":"USE_MODEL", "priority":10, "enabled":true }'

Scope a policy to one target#

Set scopeId to a specific agentId / toolId / modelId to constrain a single resource. Omit it to match every target of that scopeType.

Beyond policies: containment#

Policies decide intent. To stop AI immediately across the whole tenant with no redeploy, use Kill Switches (agentExecution, outboundMcp, externalLlm, …). For a single misbehaving run, terminate its Session.

See the full model in AI Policies and the complete field list in the API Reference.