> ## Documentation Index > Fetch the complete documentation index at: https://www.osohq.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Policies > Define rules that control what AI agents are allowed to do across your organization. Policies are coming soon. Talk to us if you'd like early access. Policies let you move beyond observing what agents do, to actively controlling them. You can target individual or groupings of tool calls, limit specific operation types like writes or deletes, restrict entire integrations, block a specific agent outright, or trigger on agent discovery before any tool call is made. Additionally, actions go beyond blocking - you can alert, require human approval, or trigger a security escalation that blocks the call and immediately notifies your security team. ## Writing a policy MCP servers are a common way agents invoke tools, but they're not the only surface. Agents are resourceful, and if one route is blocked, they may find another: a CLI command, an SDK call, or a direct API request. Oso canonicalizes tool calls across all surfaces. It maintains a built-in catalog of known tools for each supported integration, with each tool classified by operation type: **Read**, **Write**, or **Delete**. You write one policy, and Oso enforces it regardless of how the agent invoked the tool. Start by setting your conditions. You can match on integration, operation type, a specific tool name, agent name, or review status, in any combination. Then choose an action: **Block** the call outright, **Alert** and notify via Slack, **Require human approval** before the call goes through, or trigger a **Security escalation** that blocks the call and immediately notifies your security team. For example: to block all writes to GitHub, set the integration to GitHub, the operation to Write, and the action to Block. It applies whether the agent used the GitHub MCP server, ran a git command from the CLI, or called the GitHub SDK directly. ## Supported integrations Policies cover MCP server calls, CLI commands, and SDK calls. A policy on Git covers `git commit`, `git push`, `git clean`, and every other git command, regardless of whether the agent invoked it through an MCP server, directly from the CLI, or via an SDK.

More integrations are being added. If you need support for a specific one, reach out. ## Example policies ### Security escalation on GitHub writes and deletions A single policy covers the full GitHub surface. No need to enumerate individual tools or API calls. ```yaml theme={null} Name: Security escalation on GitHub writes and deletes ``` ```yaml theme={null} When: An agent makes a tool call If: Tool belongs to GitHub If: Tool call type is Write or Delete ``` ```yaml theme={null} Action: Security escalation ("block and notify security team immediately") ``` *** ### Require human approval before deleting a Linear issue Target a specific tool call for tighter control over high-impact actions. ```yaml theme={null} Name: Human approval for Linear deletions ``` ```yaml theme={null} When: An agent makes a tool call If: Tool belongs to Linear If: Tool name is Delete issue ``` ```yaml theme={null} Action: Require human approval ``` *** ### Alert when Cursor makes any delete call Scope a policy to a specific agent without applying the same rule org-wide. ```yaml theme={null} Name: Alert on Cursor deletes ``` ```yaml theme={null} When: An agent makes a tool call If: Agent name is Cursor If: Tool call type is Delete ``` ```yaml theme={null} Action: Alert ``` *** ### Alert when an unsanctioned agent is discovered Fire the moment a disallowed agent appears in your inventory, before it has made any tool calls. ```yaml theme={null} Name: Alert on disallowed agent discovery ``` ```yaml theme={null} When: An agent is discovered If: Agent review status is Disallowed ``` ```yaml theme={null} Action: Alert ``` ## Get early access Policies are in active development. Reach out to get involved in the early access program.