Create a agent-policy
POST /agent-policies
Authorizations
Section titled “Authorizations ”Request Body required
Section titled “Request Body required ”object
object
Determines what scope_value refers to: org = org-level policy, environment = named env (dev/prod/…), action_type = action type pattern.
The scoped value: org documentId, environment name, or action type pattern. Null means applies to all within the org.
L0=observe only (no writes), L1=suggest only (no writes), L2=execute with approval, L3=auto-execute within policy.
Array of time windows where all agent actions are blocked. Format: [{name: string, start: ‘HH:MM’, end: ‘HH:MM’, days: number[], timezone: string}]. days: 0=Sunday…6=Saturday.
Maximum scope of impact a single agent action may have under this policy.
Explicit allowlist of action type strings. Null = all action types are allowed within the autonomy_level.
Explicit blocklist of action type strings. Takes precedence over allowed_action_types.
True when this policy was created by an agent. Used by no-self-policy-mutation guard to reject agent-initiated mutations.
Legacy OPA-compatible policy document. Format: { allow_actions: string[], deny_actions: string[], conditions: { max_instances_per_day?: number, allowed_regions?: string[], … } }
Legacy: Policy specificity scope for OPA matching priority (per-action > per-env > per-provider > global).
Legacy: Glob-style pattern matched against the requested action. ’*’ matches all.
Responses
Section titled “ Responses ”Created
object
object
Determines what scope_value refers to: org = org-level policy, environment = named env (dev/prod/…), action_type = action type pattern.
The scoped value: org documentId, environment name, or action type pattern. Null means applies to all within the org.
L0=observe only (no writes), L1=suggest only (no writes), L2=execute with approval, L3=auto-execute within policy.
Array of time windows where all agent actions are blocked. Format: [{name: string, start: ‘HH:MM’, end: ‘HH:MM’, days: number[], timezone: string}]. days: 0=Sunday…6=Saturday.
Maximum scope of impact a single agent action may have under this policy.
Explicit allowlist of action type strings. Null = all action types are allowed within the autonomy_level.
Explicit blocklist of action type strings. Takes precedence over allowed_action_types.
True when this policy was created by an agent. Used by no-self-policy-mutation guard to reject agent-initiated mutations.
Legacy OPA-compatible policy document. Format: { allow_actions: string[], deny_actions: string[], conditions: { max_instances_per_day?: number, allowed_regions?: string[], … } }
Legacy: Policy specificity scope for OPA matching priority (per-action > per-env > per-provider > global).
Legacy: Glob-style pattern matched against the requested action. ’*’ matches all.
Validation error
Missing or invalid authentication
Not authorized (tenant scope or capability)