Policies

The verbs the deciding policy version lists, wire names, in its order. ["connector_action"] on an action row. Empty for a caller holding only alerts:read.

inline | policy | engine | connector (kind=action rows): who decided.

decision for a decision about an interaction; action for something a rule or a person did through a connection.

The verbs the deciding policy version lists, wire names, in its order. ["connector_action"] on an action row. Empty for a caller holding only alerts:read.

inline | policy | engine | connector (kind=action rows): who decided.

decision for a decision about an interaction; action for something a rule or a person did through a connection.

open | acknowledged | resolved | suppressed.

draft | monitor | enforce — the policy's mode for this workspace now.

true for a policy provided by Oxelone rather than written by the workspace.

The verbs the deciding policy version lists, wire names, in its order. ["connector_action"] on an action row. Empty for a caller holding only alerts:read.

inline | policy | engine | connector (kind=action rows): who decided.

decision for a decision about an interaction; action for something a rule or a person did through a connection.

open | acknowledged | resolved | suppressed.

The display name, e.g. Shell command, Tool call.

Per action kind; a kind absent here has no hook on this tool.

The registry's display name (Claude Code, Devin Desktop).

What the tool does when its hook times out: open or closed.

The registry slug (claude_code).

The hook timeout we write into the tool's config, or null where it has no field (Windsurf: its own limit is unmeasured).

On (true) or Off. Off pauses every member.

The members, in member order.

A provided group this workspace removed (listed with the removed policies).

Hits per UTC day, oldest first, today last, zero-filled: always seven entries, all zeros for a policy last hit before the window.

Hits in the trailing seven UTC days: the sum of daily. Not the same figure as last_30d on GET /policies/{id}/hits, which is a rolling 30 days.

Every hit this policy has ever had.

The same thing in a sentence, for an operator who is not going to look the reason code up.

The policy's own name, so an operator recognises it in the list. The id is the handle they act on.

Stable and machine-readable: label_not_emittable, no_backend, engine_has_no_runner, or engine_unknown. no_backend is the one you can fix, by choosing a backend for the engine; engine_has_no_runner cannot be fixed by any setting.

The canonical label the condition binds, when the warning is about one.

The reason given when enforcement was halted; always present.

The reason given when enforcement was halted; always present.

The reason given when enforcement was halted; always present.

The group's id, or the policy's (own or provided).

group or policy.

The group's id, or the policy's (own or provided).

group or policy.

The group's id, or the policy's (own or provided).

group or policy.

changed, unchanged (it already had that mode), refused (see refusal; nothing was written for it), or not_found.

The mode it is in after this change — enforce where monitor was asked for and the policy holds nothing back — or null when it was refused or not found.

Why it was refused, as a sentence, or null.

Whether this publish happened while enforcement is halted, and therefore enforces nothing whatever the policy list says.

Policies that compiled but cannot fire in this workspace as it is configured — almost always because of which backend an engine is set to. Empty is the normal case.

A warning and not a refusal: such a policy is undetermined rather than invalid, and refusing the compile would let switching a backend brick publishing for a whole workspace. Silence was the other option, and it is the worse one — an operator would leave a policy in enforce believing it covers something nothing is looking for.

The working directory, as the agent normalises it (~/src/app).

alert or webhook.

An Alert that also tells the person in the moment (Notify).

The policy's own decision: allow, ask, block (or redact for a Network policy).

Its place in the list, from 1.

matched, no_match, other_action, out_of_scope, disabled, monitor or undetermined.

Why, in one line.

The policy's own decision: allow, ask, block (or redact for a Network policy).

Its place in the list, from 1.

matched, no_match, other_action, out_of_scope, disabled, monitor or undetermined.

Why, in one line.

allow, ask or block, the strictest of the matched policies winning, or undetermined when the outcome waits on an engine result, which a simulation does not run. For an Ask with no companion running this is still ask; what happens then is if_no_companion's sentence.

The policies that decided it: every merged Ask, or the blocking ones.

The merged question, as the person would read it; null for Oxelone's default wording.

native or companion.

The first item the filter matched (a rule, an MCP server, a plugin), when it matched one.

scope_names_missing_profile or targets_hook_actions.

A sentence for the policy's author, meant to be shown as it is.

Whether this publish happened while enforcement is halted, and therefore enforces nothing whatever the policy list says.

Policies that compiled but cannot fire in this workspace as it is configured — almost always because of which backend an engine is set to. Empty is the normal case.

A warning and not a refusal: such a policy is undetermined rather than invalid, and refusing the compile would let switching a backend brick publishing for a whole workspace. Silence was the other option, and it is the worse one — an operator would leave a policy in enforce believing it covers something nothing is looking for.

The same thing in a sentence, for an operator who is not going to look the reason code up.

The policy's own name, so an operator recognises it in the list. The id is the handle they act on.

Stable and machine-readable: label_not_emittable, no_backend, engine_has_no_runner, or engine_unknown. no_backend is the one you can fix, by choosing a backend for the engine; engine_has_no_runner cannot be fixed by any setting.

The canonical label the condition binds, when the warning is about one.

Aligned with bucket_starts.

0–1, of decisions.

Whether this publish happened while enforcement is halted, and therefore enforces nothing whatever the policy list says.

Policies that compiled but cannot fire in this workspace as it is configured — almost always because of which backend an engine is set to. Empty is the normal case.

A warning and not a refusal: such a policy is undetermined rather than invalid, and refusing the compile would let switching a backend brick publishing for a whole workspace. Silence was the other option, and it is the worse one — an operator would leave a policy in enforce believing it covers something nothing is looking for.

Whether this publish happened while enforcement is halted, and therefore enforces nothing whatever the policy list says.

Policies that compiled but cannot fire in this workspace as it is configured — almost always because of which backend an engine is set to. Empty is the normal case.

A warning and not a refusal: such a policy is undetermined rather than invalid, and refusing the compile would let switching a backend brick publishing for a whole workspace. Silence was the other option, and it is the worse one — an operator would leave a policy in enforce believing it covers something nothing is looking for.

Whether Oxelone can run this verb in this workspace: a connector exists for it, the subject carries a live request to act on, or a destination is stored. It does not depend on how many machines are enrolled.

Where the verb runs, derived from the verb: inline for an enforcing verb, connector for a connector verb, otherwise server_async.

The configuration keys this verb takes, in display order — for ask, message and require_reason.

How many of this workspace's machines this verb would act on today.

Zero is a normal answer. It is the coverage strip's sentence — fires on 0 of your machines today — and not a reason to hide a verb; an author can write a real policy before enrolling anything, and that is the case this field exists for.

Per verb rather than one number for the document, because the verbs genuinely differ and the differences are the interesting part: block counts machines whose capture sits in the request path, redact counts the narrower set whose capture reads a body at all, and alert counts every live machine because a server-side alarm needs nothing from the endpoint. A single count would be wrong for redact on a metadata fleet, which is the one sentence the whole coverage strip exists to say.

Why this verb is unavailable, as a full sentence. Present exactly when available is false.

Whether this engine will answer in this workspace, the same answer GET /engines gives. An unavailable engine is still listed: a row may be written over it, and the editor warns beside the row.

The engine's display name, as the engine list shows it.

The engine's id, as a policy's engine filter names it.

The fields of the engine's own output a filter may read. Empty until the engine publishes them.

Only for llm-judge, and empty for every other engine.

The label vocabulary, narrowed to the backend this workspace selected. An unemittable label is listed and flagged rather than dropped: a policy written against a build that could emit it must still render, and the editor must still not offer it as a new condition.

The artifact events a Host policy over this category may be triggered by, in the File Events page's own order.

Not the same list for every category — HostCategory:: offered_events withholds content_changed from a category nothing hashes, and an AI Tool is an installation rather than a file. A picker that offered it anyway would let an author arm a trigger that can never fire, which is the placebo this whole document exists to prevent.

Why a filter over this category's content is refused, or absent when it is not refused — the domain own sentence, shown verbatim.

This is what keeps the narrowing from being unexplained. Switching a policy to Model weights takes the content filters out of the picker, and a picker that quietly gets shorter reads as a bug. The editor prints this beside the count it dropped.

Verbs this category alone offers, and on which triggers — today, Fix on AI tool, while present. Absent on every other category.

The engines that will answer a filter written under this input. An engine that reads its subject by reference (rather than its text) is listed only under file_name on Host and request on Network.

The Host categories that allow it, as category ids. Empty means every one — a file's name and location are known whatever the file is. file_contents names the five categories that carry text; the three opaque ones and AI Dependency (read as entries rather than text) are absent. A Host policy that has picked no category may read contents. Empty on a Network document; always present.

The value a row's input carries: prompt | attachment | request | file_contents | file_name.

The sub-category choices under which this input is offered, where all means a policy that has not picked one. Empty means every choice, which is what the prompt and the whole request answer; only the attachment narrows, to ["all", "attachment"]. Empty on a Host document; always present.

The display name: The prompt, The file's contents.

The field a plain text filter over this input uses: contains and matches pattern are filters over prompt_text, attachment_text, body, artifact_text or artifact_path, not engine filters.

Why a Redact response is refused under this kind, or absent when it is not. No kind carries one today: a text attachment is rewritten, and a binary one carrying a named type is withheld.

The group this field is listed under: destination | application | identity | content | finding | context.

Machines in this workspace on which this predicate can be evaluated.

The filter's kind, exactly as a policy body writes it: service_is, body_contains, engine_label, and so on.

The field's display name, and only the name.

agent | server — where a filter over this field is answered: on the machine, or by Oxelone. One server-side filter moves the whole policy to the server.

The comparisons that can be evaluated over this field, in the order to offer them. Any other comparison is refused.

Whether machines on this tactic capture content. False for metadata and none, where content filters cannot match.

A capture tactic: extension, redirect, mitm_ca, metadata or none.

One machine is on exactly one tactic, so these counts sum to the workspace's live machine count.

One line on what it covers.

A name, never a sentence: Criminal AI.

vendor (Oxelone's: additions only) or workspace (this workspace's own: renamed, described and deleted here).

What a policy stores: $criminal-ai.

How many of this workspace's Network policies name it. Only the Coverage Matrix's list carries it.

The live connections this workspace has. Always present on a Connector document, because the trigger step's first control is this Select.

Empty without connection=: a record kind is a fact about one connection's credential, and answering for "any of them" would offer a catalogue no connection has.

What the row needs from the author: filter (it acts on what the filter matched), list (rules or sources typed in), mode (a start mode picked) or none.

The eight kinds, in picker order.

The action this document's predicates and actions are for — the query's action — or null when none was asked, in which case predicates is every Hook filter and each kind's fields narrows it.

On (true) or Off. Off pauses every member.

The members, in member order.

A provided group this workspace removed (listed with the removed policies).

Whether this publish happened while enforcement is halted, and therefore enforces nothing whatever the policy list says.

Policies that compiled but cannot fire in this workspace as it is configured — almost always because of which backend an engine is set to. Empty is the normal case.

A warning and not a refusal: such a policy is undetermined rather than invalid, and refusing the compile would let switching a backend brick publishing for a whole workspace. Silence was the other option, and it is the worse one — an operator would leave a policy in enforce believing it covers something nothing is looking for.

Whether this publish happened while enforcement is halted, and therefore enforces nothing whatever the policy list says.

Policies that compiled but cannot fire in this workspace as it is configured — almost always because of which backend an engine is set to. Empty is the normal case.

A warning and not a refusal: such a policy is undetermined rather than invalid, and refusing the compile would let switching a backend brick publishing for a whole workspace. Silence was the other option, and it is the worse one — an operator would leave a policy in enforce believing it covers something nothing is looking for.

On (true) or Off. Off pauses every member.

The members, in member order.

A provided group this workspace removed (listed with the removed policies).

Whether this publish happened while enforcement is halted, and therefore enforces nothing whatever the policy list says.

Policies that compiled but cannot fire in this workspace as it is configured — almost always because of which backend an engine is set to. Empty is the normal case.

A warning and not a refusal: such a policy is undetermined rather than invalid, and refusing the compile would let switching a backend brick publishing for a whole workspace. Silence was the other option, and it is the worse one — an operator would leave a policy in enforce believing it covers something nothing is looking for.

On (true) or Off. Off pauses every member.

The members, in member order.

A provided group this workspace removed (listed with the removed policies).

Whether this publish happened while enforcement is halted, and therefore enforces nothing whatever the policy list says.

Policies that compiled but cannot fire in this workspace as it is configured — almost always because of which backend an engine is set to. Empty is the normal case.

A warning and not a refusal: such a policy is undetermined rather than invalid, and refusing the compile would let switching a backend brick publishing for a whole workspace. Silence was the other option, and it is the worse one — an operator would leave a policy in enforce believing it covers something nothing is looking for.