Skip to main content

Policy Templates

Policy templates provide pre-configured starting points for the five built-in policy types. They are available in the dashboard's create flow and via the GET /api/policies/templates endpoint.

Available templates​

Tool Allowlist​

Controls which tools an agent may call. Uses glob pattern matching.

Type:        Tool ACL
Default mode: Shadow
Rule logic:  MATCH_TOOL_CALL → ENFORCE_ALLOWLIST

Use this when you want to restrict an agent to a known set of approved tools and deny everything else. Start in Shadow mode to see what would be blocked before enforcing.

Domain Allowlist​

Controls which network domains outbound tool calls may reach.

Type:        Domain ACL
Default mode: Shadow
Rule logic:  MATCH_OUTBOUND → ENFORCE_DOMAIN_LIST

Use this to prevent data exfiltration by limiting which external APIs an agent can contact. Patterns like *.example.com are supported.

Cost Budget​

Caps cumulative token spend per session or per agent.

Type:        Cost Governance
Default mode: Active
Rule logic:  MATCH_COST → ENFORCE_BUDGET

Use this to prevent runaway model costs. The default budget is $10.00 per session. When the budget is exceeded, subsequent actions are blocked with a clear error.

Rate Limit​

Throttles tool call frequency within a sliding time window.

Type:        Rate Limit
Default mode: Active
Rule logic:  MATCH_TOOL_RATE → ENFORCE_RATE_LIMIT

Use this to prevent runaway loops or excessive tool invocation. The default is 60 calls per 60-second window. When exceeded, the SDK returns a throttle decision.

PII Detection​

Scans tool inputs and outputs for sensitive data patterns.

Type:        Data Classification
Default mode: Audit
Rule logic:  MATCH_CONTENT → CLASSIFY_AND_ACT

Use this to detect PII (Social Security numbers, email addresses, and other sensitive patterns) flowing through agent tool calls. Default action is alert — the action proceeds but a telemetry event is emitted. Can be switched to block for strict environments.

Using templates​

Dashboard​

Navigate to Policies → New policy. Select a template from the "Start from template" dropdown. The template populates the policy name, type, enforcement mode, and logic blocks. Edit as needed before saving.

API​

# List available templates
curl -s https://api.pavri.ai/api/policies/templates | jq '.data[].name'

# Create a policy from a template's defaults
curl -X POST https://api.pavri.ai/api/policies \
  -H "Content-Type: application/json" \
  -d '{"name": "prod-tool-guard", "type": "Tool ACL", "enforcementMode": "Shadow"}'

Customizing templates​

Templates are starting points. After creating a policy from a template, you can:

  • rename the policy and add a description
  • switch enforcement mode (Active / Shadow / Audit)
  • modify the rule parameters (patterns, budgets, thresholds)
  • assign the policy to specific agents