Skip to main content
POST
Create a policy
Requires Policies enabled and an active workspace member with administrator access as the caller. Reads require policies:read; writes require policies:write. REST access is not available yet. It depends on planned support for API keys associated with workspace members. These endpoints do not accept signed-in user tokens. Creates a draft, without activating enforcement. Supply name, subject, conditions (a CEL expression), enforcement (audit or required), and approvals (steps containing a positive integer count). Required enforcement supports one step. Charge amounts use major currency units; specify currency when setting a threshold.
Activate the draft separately to enable enforcement. Use the Idempotency-Key header for an identical write retry. Through MCP, use idempotency_key in the tool arguments.

Agent proposals

The agent can discover these capabilities through its catalog. Write proposals require policies:request and Read. Request tools return an unapplied Changeset; a permitted person must authorize application. Policy activation is an explicit proposal separate from draft creation.

Returns

Returns the resulting policy and its lifecycle state.