Dashboard
Policy configuration
Tune the runtime policy cascade from the dashboard.
The Policy configuration screen is where you tune the runtime cascade, custom blocklist, sampling, and trace content mode for a project. It is the visual editor for what the runtime policy reference describes.
Policy tabs#
| Tab | Controls |
|---|---|
| General | Enforcement mode, fail-open, global max attempts, and the observability content mode. |
| Input guard | Instruction-hijacking detection, prompt armoring, context splicing, and the custom blocklist. |
| Tool guard | Enable and threshold tool-call detection; interception rules. |
| Output guard | Response moderation, output gating, sampling constriction, and streaming policy. |
| Escalation | Model escalation for flagged attack classes. |
| Advanced | Default-off chain-of-thought integrity and its fallback divergence threshold. |
Editing thresholds#
Input, Tool, and Output guards each have an enable toggle and two sliders: Flagged threshold (“scores at or above this are flagged”) and Unsafe threshold (“scores at or above this are treated as unsafe”). They are shown as percentages but stored as values from 0 to 1. Lower the flagged threshold to surface more observed risk; lower the unsafe threshold to block more aggressively in Enforce.
Each slider overlays the recent project score distribution and estimates how many checks land at or above the selected value. Integrity does not choose or change the value for you. Follow Thresholds and calibration before you enable blocking.
The shared slider axis is continuous, but current tool scores are 0, 0.5, or 1, and recognized output labels score 0, 0.75, or 1. For those guards, a threshold move changes decisions only when it moves past one of the emitted score bands.
INT-CoT under Advanced has one fallback divergence threshold. A source-model-calibrated threshold takes precedence when available. It has no independent unsafe verdict: material, rising divergence must coincide with a flagged tool call or output.
Where policy applies#
Policy governs gateway traffic for the project. Changes take effect after the runtime config cache refreshes, normally within about 15 seconds. Use Observe to preview the impact of a change before enforcing it. Editing requires the role capability project.policy.write.