Policies and decisions
A Policy is a named, versioned set of rules. Assign a published Policy to an Agent (or a workspace or Connection) and Aethis applies its rules to every governed action in scope.
Decisions
Section titled “Decisions”Every governed action gets exactly one decision:
| Decision | What happens |
|---|---|
| Allow | Aethis forwards the call to the upstream server and records the result. |
| Require Approval | Aethis holds the call and creates a request in the Approval Queue. Nothing runs until a reviewer decides. |
| Block | Aethis stops the call. No upstream execution is attempted. |
Redaction is not a decision. Redacting personal data, payment data or secrets is an Agent control that applies alongside whatever the policy decides.
Each rule names who it applies to, which tool on which Connection, which resource, an optional condition, and the decision. The dashboard reads a rule back as a sentence, for example:
Require Approval Billing Agent to use tool refund.create from Finance MCP on stripe.production when amount is above SGD 1,000.
The full field list is in the Policy rule model.
When more than one rule could match
Section titled “When more than one rule could match”- Scope comes first. A rule for a specific operation and a specific Agent is more specific than a rule for that operation and any Agent, which is more specific than a rule that matches a tool’s reviewed meaning (a Semantic Profile). If nothing decides the action, it remains Unresolved rather than becoming an implied Allow.
- Keep same-scope rules disjoint. Conditions at the same scope should cover separate ranges or cases. If two same-scope rules overlap and disagree, narrow one before publishing.
- Treat priority as descriptive metadata. The editor displays and validates a numeric priority, but you should not rely on that number to make conflicting same-scope rules safe.
See Rule precedence for the full order.
Versions and publishing
Section titled “Versions and publishing”- You edit a draft. Drafts don’t affect any Agent.
- Publish Version turns the draft into an immutable published version with its own version label (for example
payments-v12) and hash. - Agents run against the published version. Every Action Record names the Policy version and the matched rule that produced its decision.
- To change a published book, create a new draft from it and publish again. Earlier versions stay in the book’s history.
Where a Policy applies
Section titled “Where a Policy applies”A Policy has a scope, such as Workspace · Production or Organization · All, and assignments to Agents, workspaces or Connections.
On an Agent’s Policies section, each book shows how it arrived:
- Direct: assigned to this Agent.
- Required: required by the organization. You can’t detach it from the Agent.
- Inherited: applied through a workspace or organization assignment.
Organization Policies can be offered to workspaces as Available, turned on by default (Default On), or made Required.
Library states
Section titled “Library states”| State | Meaning |
|---|---|
| Active | Published and enforced. |
| Draft | Not published yet. |
| Disabled | Published but not enforced. You can enable it again. |
| Archived | Retired. Custom books can be restored. |
| Conflict | A rule or assignment references something that no longer resolves, such as a removed Connection. Create a draft to fix the reference and republish. |
Books are either Custom (yours) or Aethis Managed (templates you can clone and adapt).
Test before you rely on it
Section titled “Test before you rely on it”Use Evaluate policy on an Agent’s Tools section to check an exact action against the Agent’s policies without running it. Observe Mode goes further: it records what a policy would do to real traffic while execution continues unchanged.