> ## Documentation Index
> Fetch the complete documentation index at: https://www.osohq.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.
# Policies
> Define rules that control what AI agents are allowed to do across your organization.
Policies let you control what agents can do. Set conditions to match specific agent activity, then choose what happens when it matches: alert your team, enforce a restriction, or both.
## Writing a policy
A policy has conditions, grouped into three fields - **Actor**, **Operation**, and **Resource** - and a **Response** for what Oso does when it matches. Only Actor and Response are required; Operation and Resource conditions are optional and addable.
### Actor
Who's involved:
* **Agent name** - a specific agent, like Claude or Codex
* **Agent review status** - Unreviewed, Allowed, or Disallowed
If you've connected an [identity provider](/docs/oso-for-agents/identity-sync), you can also match on the user or group driving the agent.
### Operation
What kind of call it is:
* **Type** - the kind of operation: Read, Write, Destructive, or Unknown
* **Tools** - one or more specific tools, searchable, each tied to its integration (Gmail, GitHub, etc.); tools with no known integration show up as **Unclassified**
* **Connectors** - matches every call made through a specific CLI or MCP integration point (for example, Linear accessed through Claude.ai's MCP connector)
### Resource
What it touches:
* **Provider** - the upstream system a tool belongs to (GitHub, Gmail, etc.), or all providers
* **Content type** - matches a [content tag](/docs/oso-for-agents/content-tags) you've defined (for example, "PHI" for a healthcare company) - scans both the request and the response
### Response
Choose Alert, Enforce, or both:
* **Alert** - notify your team. Set a severity (Low, Medium, High, Critical) and a cadence (every time, or throttled to once every 5 minutes, 15 minutes, 30 minutes, 1 hour, or 24 hours). Alerts route to the Slack channel you've already connected under Connections.
* **Enforce** - restrict the matching call. Choose one:
* **None - monitor only**
* **Block** - prevent the call from proceeding. For a policy that scans a tool's response (a content-type condition), the call has already run by the time it's scanned, so Block instead redacts the response.
* **Require user approval** - pause until the end user allows or denies it.
* **Require security approval** - block until your security team grants a one-time exception.
Add a message when you enforce - it's shown to the agent or user when the policy triggers.
Content-type conditions support Alert as usual, but Enforce is limited to **Block** - content that's already entered the model's context can't be held for user or security approval.
### Policy preview
As you build a policy, the preview panel shows exactly how it'll behave:
* **Runs on** - which event types the policy is evaluated against, derived automatically from your conditions: a policy scoped to a specific tool (by Type, Tools, Connectors, or Provider) runs on the tool request; add a Content type condition to that same policy and it also runs on the tool response; a policy with no tool-scoping condition (matching only on Actor or Content type) runs on all three - user prompt, tool request, and tool response
* **Matches** - the specific tools and agents the policy currently matches
* **Then** - the resulting action
For example, a policy that blocks destructive actions from approved agents shows **Runs on: Tool request**, **Matches**: every destructive tool and your allowed agents, and **Then: Blocks the tool call**.
## Supported integrations
This isn't exhaustive - Oso supports more integrations than shown here, with new ones added regularly.
Oso also recognizes common shell commands (`rm`, `chmod`, `mv`, `tar`, and similar) as a built-in **System** integration, for CLI activity that isn't tied to one of the integrations above.
More integrations are being added regularly, and we're building the ability to automatically identify integrations Oso hasn't cataloged yet - not just the ones listed here. If you need support for a specific one now, reach out.
## Example policies
### Require security approval for GitHub writes and deletions
```yaml theme={null}
Name: Require security approval for GitHub writes and deletes
```
```yaml theme={null}
Operation:
Type: Write, Destructive
Resource:
Provider: GitHub
```
```yaml theme={null}
Enforce: Require security approval ("Blocked pending security review")
```
***
### Require user approval before deleting a Linear issue
```yaml theme={null}
Name: User approval for Linear deletions
```
```yaml theme={null}
Operation:
Tools: Delete issue
```
```yaml theme={null}
Enforce: Require user approval ("This needs your OK before it runs")
```
***
### Alert when Cursor makes any destructive call
```yaml theme={null}
Name: Alert on Cursor destructive calls
```
```yaml theme={null}
Actor:
Agent name: Cursor
Operation:
Type: Destructive
```
```yaml theme={null}
Alert: Medium severity, every time
```
***
### Alert when an unsanctioned agent is discovered
```yaml theme={null}
Name: Alert on disallowed agent discovery
```
```yaml theme={null}
Actor:
Agent review status: Disallowed
```
```yaml theme={null}
Alert: Medium severity, every time
```
***
### Block and alert on a custom regex match
```yaml theme={null}
Name: Block serious prod regex
```
```yaml theme={null}
Actor:
Agent name: Cursor
Resource:
Content type: Serious prod regex
```
```yaml theme={null}
Alert: Medium severity, once every 30 minutes
Enforce: Block ("Can't use this regex")
```
Since this policy has no tool-scoping condition, it runs on every point in the session - user prompts, tool requests, and tool responses. It alerts your team at most once every 30 minutes, and blocks any match - redacting the response if the match is only found there.
***
### Block API key leaks in any session
```yaml theme={null}
Name: Block API key leaks
```
```yaml theme={null}
Resource:
Content type: API keys
```
```yaml theme={null}
Enforce: Block
```
## Get help
Reach out if you need support for an integration or condition type not covered here.
This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.
