Policies

#What is a policy?

A policy is a review rule that runs independently of the agent's judgement. When an agent wants to write a record to a collection, write a file or post to a channel, the content passes through your policies first. If the content trips a rule, one of two things happens.

• With Block selected, the content is never written. The agent sees why and tries to bring the content in line with the rule. You see a red step and its reason in the run history.
• With Watch only selected, the content is written and the event shows up in the "Recent events" list under Settings. That is the setting to use when you want to watch a new rule before you switch it to blocking.

It works differently from an instruction you give in a session. An instruction is text the agent reads and tries to follow, while a policy is a gate built into the code and it runs even when the agent would rather not comply.

#Who manages them?

Admin only. The Settings → Policies tab never appears for members who are not admins. Until you add a policy, nothing in the workspace behaves any differently.

The policies you add sit one below the other in a list; each row carries the policy's name, what it reviews, what it does when content trips it and how many writes it caught in the last 7 days. The counter only counts blocked and watched writes; events where the check did not run are left out. Click the row and the policy's panel opens: the full text of the rule, editing, pausing, deletion and that policy's own recent events are there. Edit opens the same steps, filled in; you change the rule, the places it checks or the choice between blocking and watching, and save.

#Adding a rule: three steps

The New policy button opens a three-step window.

1. Start. Pick a rule from the gallery of ready-made rules or write one from scratch. A ready-made rule can be edited on the next step.
2. Write and try the rule. The policy's name, what it checks and the rule itself live here. For a pattern review the regular expression sits under the "Advanced" heading; when you use a ready-made rule you never need to open it. On the same step you try the rule with a sample text.
3. What happens? Block or watch only. A sentence under the choice says what will happen.

#Trying it with a sample text

On the second step you paste a sample text and press Try with the sample. The rule runs exactly as it would in a real write and shows the result at once: whether the text tripped the rule, the reason for an AI review, and the matched part for a pattern review. A trial writes nothing to the event list. An AI review trial spends credits like a real review does, and a note next to the button says so; a pattern review trial is free.

#Two kinds of review

• AI review. You write the rule in your own words, for example "It is a violation if the content contains personal data such as a national ID number, card number or phone number." On every write a small AI reviewer judges the content against that rule. This review has a small cost and comes out of your credit.
• Pattern review. You describe the pattern you are looking for directly, for example "a 13-16 digit card number sequence". No AI runs, so it costs nothing and the result is always the same. Prefer it for clear-cut patterns.

#What gets checked?

A single policy can cover collection records, files and the messages agents post to channels at the same time. You write the rule once and tick the boxes you want.

If the review itself cannot be carried out (the AI reviewer could not be reached, say), the content is still written and the event is listed as "Not checked". A policy works like a safety net, and when it cannot run it does not stop the system.

#Reading recent events

The "Recent events" list at the bottom of the page describes each event in sentences: which agent was writing where, and what happened to the content. The label at the start of the row gives the outcome.

• Blocked. The content tripped the rule and was not written.
• Warning. The content tripped the rule but was written, because the policy only watches.
• Not checked. The check did not run and the content was written unchecked.

Below that you find the reviewer's reason and, when the event happened while working on a card, a link to that card. Watch-only policies also show the part of the content that tripped the rule. For blocked content that part is not stored, because a blocked piece of personal data sitting in the event list would defeat the block.

The two filters above the list narrow the events by policy and by result. The list in the policy panel shows only that policy's events; a busy neighbour cannot push them out of the list.

#Gallery of ready-made rules

The gallery offers ready-made rules under four headings. For the ones that use pattern review the regular expression is already written; you never see it.

• Privacy: personal data (AI), Turkish ID number, IBAN, phone and email, card number.
• Security: API key and password, internal address and localhost link.
• Brand and tone: em dash ban, rude tone (AI), content language (AI).
• Commercial risk: price or delivery date commitment, competitor name mention, customer name mention, legal and medical advice. All four are AI reviews; the competitor and customer rules expect you to add your own names.

A ready-made rule fills the second step in for you, and you can edit it however you like before saving. The phone and email rule only watches by default, because contact details in a customer collection are usually legitimate.