Policy configuration fields
Look up writable family fields, defaults, valid values, bounds, and replacement behavior.
Policy configuration contains the settings for one policy family. Edit it at Policies → Policy → Edit draft or through the Policy API. Publication and executor adoption remain separate.
Shared validation
A policy has a family, top-level mode, configuration, and assignments. The configuration tables enumerate its family fields. Unknown fields, invalid types, unsupported enum values, nulls, duplicate rule IDs, and invalid cross-field combinations reject the draft update. Rule IDs are immutable strings of 1–64 ASCII letters, digits, underscores, or hyphens within one policy.
On creation, omitted fields use the defaults in this reference. The API draft update replaces the entire configuration; omitted family fields in that replacement receive their defaults. Omitted top-level PATCH fields preserve their current values. An explicit empty rule list removes those rules from the draft. No enforcement changes until publication and adoption.
Top-level mode is monitor by default and accepts monitor or block. Monitor mode records matching detection and transfer rules without blocking. It does not grant access through an access policy. Compliance evaluates posture in either mode; a gateway's access policy decides how to use that result.
Edge configuration
Edge policies configure rate limits, reputation matching, and WAF inspection:
| Field | Type and default | Values and constraints |
|---|---|---|
rate_limits | Array; [] | Each rule requires id, service_ids, path_prefix, key, window_seconds, and requests |
reputation | Object; disabled | enabled boolean defaults to false; minimum_confidence is low, medium, or high, default high |
waf | Object; disabled | enabled boolean defaults to false; enabled WAF requires ruleset_version from the service's installed catalog |
A rate rule's service_ids contains 1–200 unique services. path_prefix is a literal HTTP path beginning /; / matches all paths. key is client_ip or an approved application-key identifier. window_seconds is 1, 10, or 60; requests is an integer from 1 through 1,000,000 inclusive. All are required; invalid values reject publication. See rate limiting.
Enabled WAF also requires oversized_body_action, either monitor or block; omission defaults to monitor. The actual inspection-size and protocol limits are service capabilities shown at Service → Inspection capabilities. Missing HTTPS termination prevents HTTP inspection. Managed rules use their installed rule IDs; exemptions use the separate exception resource.
Endpoint configuration
Endpoint policies configure telemetry, intelligence matching, and tamper protection:
| Field | Type and default | Values and constraints |
|---|---|---|
telemetry_categories | String array; [] | Unique supported values: process, connection, file, device; unsupported categories reject required assignments |
intelligence_enabled | Boolean; true | Matches supported active indicators; no arbitrary code execution |
tamper_protection | Boolean; true | Requires supported device capability; disabling requires endpoint maintenance authority |
An empty telemetry list still permits identity, health, and policy-acknowledgement reports. It disables the listed security-event categories; it does not uninstall the agent. Endpoint capabilities determine supported controls and local persistence.
DLP configuration
rules is an array, default []. Each rule requires these fields:
| Field | Type | Accepted input |
|---|---|---|
id | String | Unique rule ID |
classifier_id | String | Installed built-in or approved organization classifier |
channel | String | Exact supported channel identifier from the target capability catalog |
direction | String | outbound or inbound; Endpoint → Capabilities → DLP lists the directions supported by each channel |
destination_ids | String array | 1–200 configured destination IDs; a broad match requires an explicit approved destination object |
The top-level mode determines monitor versus block. Unsupported channels reject required assignments. The policy cannot imply inspection of encrypted or otherwise opaque content. Uninspectable content is monitored unless a separately supported explicit blocking rule is selected through the console. See DLP.
Device-control configuration
rules is an array, default []. Each entry requires a unique id, a supported device_class, an exact device_identifier, and access. access is monitor, read_only, or block. A class-wide selector requires the explicit identifier * and approval in the assignment review. Empty identifiers are invalid.
Top-level monitor mode records a match without restricting access. Before selecting blocking mode, check Endpoint → Capabilities → Device control for the rule's device class and action. A required action absent from that list cannot be assigned to the target. Device controls explain verification for existing mounts and open files.
Compliance configuration
Compliance policies select the required device checks:
| Field | Type and default | Constraint |
|---|---|---|
require_supported_os | Boolean; true | Checks the current platform support catalog |
require_agent_healthy | Boolean; true | Requires current reporting and no critical agent error |
require_disk_encryption | Boolean; false | Missing required capability yields unknown, never compliant |
require_screen_lock | Boolean; false | Evaluates the reported screen-lock setting; a missing required capability yields unknown |
A required failed check yields noncompliant; missing or stale required observations yield unknown. The access policy defines observation freshness and admission behavior. Use Endpoint → Compliance → Recheck to obtain a new observation; changing the policy is not itself a fresh device report.
Access configuration
Access policies configure identity grants, posture, and session timing:
| Field | Type and default | Values and constraints |
|---|---|---|
allowed_identity_group_ids | String array; [] | Unique mapped groups; an empty list admits nobody |
require_mfa | Boolean; true | Requires an acceptable current identity-provider MFA assertion |
compliance_policy_id | String; omitted | Published compliance policy; omission performs no compliance-policy evaluation |
max_age_seconds | Integer; 900 | 60–86400 seconds; used when compliance policy is present |
session_lifetime_seconds | Integer; 3600 | 60–86400 seconds; expiry requires new authorization |
reevaluate_seconds | Integer; 300 | 30–3600 seconds; cannot exceed session lifetime |
When compliance is required, noncompliant and unknown devices are denied new admission unless a separately approved access exception applies. Gateway disconnection prevents fresh authorization. Existing sessions follow adopted re-evaluation and expiry behavior; a control-plane request is not an immediate cutoff. See posture, VPN, and ZTNA.