Policy configuration catalog

Use this catalog to find the policy guide for a customer requirement. Each guide gives the configuration and runtime limits.

The catalog includes each key that the public declarative schema accepts in policy: at this time.

Active schema inventory

The active PolicyBlocks schema contains 40 policy types. It has 28 request or routing controls, 11 output controls, and one reporting-only control.

A correct block does not make a policy run by itself. The type must also occur in the applicable global or route policies.chain:

policies:
  chain:
    - prompt-injection
    - response-rewriter

policy:
  prompt-injection:
    response:
      action: block
  response-rewriter:
    rules:
      - name: add-review-note
        replacement: "\n\nAI output — verify independently."
        position: append

In this example, the two blocks run. If you remove response-rewriter from the chain, its remaining block is only stored configuration.

Runtime labels

This catalog uses these execution positions:

Label	Meaning
request	The policy reads request messages, headers, or JSON before the gateway delivers the provider response.
tool	The policy controls tools or related request fields. Each policy has specified call coverage.
preflight	The policy adds an initial marker or result without a change to request content.
routing	The chain identifies the policy. Provider selection applies the route control.
pre-upstream rewrite	The gateway applies a specified change before it sends the request.
response	The policy reads a supported provider response. Each policy has different buffered and streaming support.

Controls do not all use the same generic stage handler. Before you use a control, read its guide.

Each guide gives the output, stream support, changes, external services, and compliance operation.

Request-side policies

Policy type	Primary runtime position	Primary guide
prompt-injection	request	prompt-injection
pii-detector	request	pii-detector
hipaa-phi-detector	request	hipaa-phi-detector
rbac	request	rbac
agent-firewall	tool	agent-firewall
audit-logger	preflight	audit-logger
cjis-mode	request	cjis-mode
dlp-filter	request	dlp-filter
safety-filter	request	safety-filter
student-privacy	request	student-privacy
case-privacy	request	case-privacy
itar-ear-filter	request	itar-ear-filter
entity-list-filter	request	entity-list-filter
dual-use-filter	request	dual-use-filter
embedding-detector	request	embedding-detector
data-routing-policy	routing	data-routing-policy
language-validator	request	language-validator
external-moderation	request	external-moderation
bot-detector	request	bot-detector
content-extractor	request	content-extractor
document-analyzer	request	document-analyzer
code-sanitizer	request	code-sanitation
tool-validation	request	tool-validation
tool-security	request	tool-security
tool-budget	request	tool-budget
gdpr-compliance	request	config-compliance-policies
request-rewriter	pre-upstream rewrite	request-rewriter
regulated-execution	routing	regulated-execution reference

Reporting-only controls

These types configure reports that you request. They do not enforce runtime requests and must not occur in policies.chain.

If they occur in the chain, validation returns policy.reporting_only.

Policy type	Consumed by	Primary guide
eu-ai-act	POST /verdictan/compliance/report	config-compliance-policies

Output-side policies

Policy type	Primary runtime position	Primary guide
quality-scorer	response	quality-scorer
human-oversight	response	human-oversight
citation-verifier	response	citation-verifier
financial-compliance	response	financial-compliance
healthcare-compliance	response	healthcare-compliance
legal-privilege	response	legal-privilege
upl-filter	response	upl-filter
mnpi-filter	response	mnpi-filter
bias-monitor	response	bias-monitor
flagged-review	response	config-flagged-review
response-rewriter	response	response-rewriter

Select controls by outcome

Customer outcome	Start with	Add when necessary
Block prompt attacks	prompt-injection	embedding-detector for its documented similarity signals
Remove sensitive identifiers	pii-detector	hipaa-phi-detector, student-privacy, or case-privacy for specified domains
Protect organization data	dlp-filter	data-routing-policy to limit eligible providers
Control agent tools	tool-validation	tool-security, tool-budget, and agent-firewall for different checks
Control output quality or evidence	quality-scorer	citation-verifier and human-oversight
Change prompts or responses	request-rewriter	response-rewriter for supported non-streaming output
Add compliance text controls	Compliance policies	Read each policy limit. These controls do not show compliance.
Record an audit marker	audit-logger	Use runtime Events and Trail workflows for evidence, storage, and integrity.

Related controls do not have the same operation. For example, tool-budget checks a specified request token limit.

It does not measure total cost. audit-logger emits an allow-only marker, but it does not configure retention.

Schema and enforcement

Use these three questions when you review a block:

1. Is the YAML correct? The declarative schema gives this answer.
2. Will the block run? The applicable chain, route, conditions, and targeting give this answer.
3. What does the runtime enforce? The linked guide gives the specified inputs, verdicts, cause codes, transport support, and limits.

Important active examples:

• audit-logger supports only audit-logger: {}. Configure immutability and retention through their owning workflows.
• student-privacy detects more input keywords than its output block path. A keyword-only redaction verdict does not guarantee word replacement.
• flagged-review rejects SSE streaming requests. Several other output controls must use stream: false. Read each policy guide before rollout.

A lint result that succeeds proves only structure validation. It does not prove these runtime capabilities.

Chain and route behavior

• The chain sequence is shown. A block or escalation result stops subsequent entries in that stage.
• Conditional when clauses can filter by path, specified header value, or model.
• Targeting can scope entries to teams or gateways.
• Route-owned chains and the global chain can be different.
• Output policies examine only the response formats their guides list.
• Policies that must have the complete response can add latency. They can be unavailable on a streaming path.

When two requests have different behavior, first compare their routes. Then, compare the configuration version, target context, request type, and stream value.

Validation and rollout

Run this validation sequence on the specified pack:

verdictan policy lint --file policy-config.yaml
verdictan policy test --json
verdictan gateway run \
  --listen 127.0.0.1:41002 \
  --agent policy-verification \
  --policy-config policy-config.yaml

verdictan policy test checks pre-request decisions and documented fixture features. It does not simulate all transports.

Use representative live gateway requests to examine routes, external integrations, rewrites, response policies, redaction, and streaming.

Before broad rollout:

1. Add positive, negative, limit, and false-positive cases.
2. Test each request type and streaming mode that the application uses.
3. Verify the status, body, and nested policy results that the caller sees.
4. Match the request ID with verdictan events tail --since 10m --json.
5. Make sure that the correct gateway runs the specified configuration version.

Troubleshooting

Symptom	Likely cause	What to examine
Configuration lints but the policy does not occur	The applicable chain does not contain the block. A route, when, or targeting can also remove it.	Examine the applied global or route chain and the request context.
A correct field has no effect	The schema can accept more fields than the runtime enforces.	Read the supported fields and limits in the policy guide.
An output policy works only for some clients	The response JSON structure or streaming mode is different.	Compare the request type, stream value, and documented paths.
A specified subsequent result is missing	An earlier policy stopped the stage.	Examine the chain sequence and the block or escalation cause.
Pack tests pass but integration fails	The test runner does not simulate all gateway handlers and transport paths.	Send the specified request through a controlled gateway and upstream.
The last cause is ok after a policy allow result	A nested allow cause does not always replace the total cause.	Examine policy_results[] and the last envelope.

Next steps

• Policy control catalog
• Declarative configuration reference
• Conditional chains
• Configuration tests
• Configuration-first workflow