Skip to main content

Single-policy documents

Verdictan supports two top-level declarative structures:

  • ConfigDocument for complete gateway configurations with pack, policies, and optional providers
  • SinglePolicyDocument for one of four standalone policy structures

A single-policy document lets you lint and test one supported policy without a complete gateway configuration. A running gateway uses a complete ConfigDocument with pack and policies.chain.

Supported policy types​

Only these four policy types support the standalone document structure:

  • prompt-injection
  • agent-firewall
  • citation-verifier
  • quality-scorer

Shared structure​

Each single-policy document starts with a policy data object.

policy:
  name: prompt-injection
  version: 1.0.0
  enabled: true
FieldTypeNecessaryDescription
policy.namestringyesThe value must be one of the four supported standalone policy types.
policy.versionstringyesThis field contains a SemVer string.
policy.enabledbooleanyesThis field enables or disables the standalone policy.

A single-policy document can have no pack, policies.chain, or providers.targets top-level object.

Prompt injection document​

policy:
  name: prompt-injection
  version: 1.0.0
  enabled: true

detection:
  embedding_threshold: 0.8
  attack_patterns:
    - "ignore.*previous.*instructions"
    - "forget.*system.*prompt"

encoding:
  decode_base64: true
  normalize_unicode: true
  detect_homoglyphs: true

boundaries:
  enforce_delimiters: true
  reject_fake_boundaries: true

response:
  action: block

This structure has these top-level sections:

  • detection
  • encoding
  • boundaries
  • response

Agent firewall document​

policy:
  name: agent-firewall
  version: 1.0.0
  enabled: true

tools:
  roles:
    analyst:
      allowed:
        - "search_*"
        - "read_*"
      denied:
        - "delete_*"
    admin:
      allowed:
        - "*"

rate_limits:
  default: 60
  search_records: 120

transaction_limits:
  max_single_transaction: 10000.0
  max_daily_total: 50000.0
  require_approval_above: 5000.0

kill_switches:
  halt_on_pii_in_action: true
  halt_on_suspicious_pattern: true

max_actions_per_session: 500

This structure has these top-level sections:

  • tools
  • rate_limits
  • transaction_limits
  • kill_switches
  • max_actions_per_session

Citation verifier document​

policy:
  name: citation-verifier
  version: 1.0.0
  enabled: true

verification:
  require_source_match: true
  min_groundedness: 0.8
  extract_patterns:
    - academic
    - url

rag_context:
  verify_against_context: true
  min_context_overlap: 0.7

output_action:
  unverified_action: flag

response:
  include_verification_report: true

This structure has these top-level sections:

  • verification
  • rag_context
  • output_action
  • response

Quality scorer document​

policy:
  name: quality-scorer
  version: 1.0.0
  enabled: true

benchmarks:
  ragas_faithfulness: true
  ragas_relevancy: true

assertions:
  - type: contains
    config:
      value: "source"
  - type: word-count
    config:
      min: 50
  - type: llm-rubric
    config:
      rubric: "The answer should be accurate, concise, and grounded in evidence."
    threshold: 0.8

thresholds:
  min_aggregate: 0.75
  min_faithfulness: 0.75

weights:
  faithfulness: 0.4
  relevancy: 0.35
  bleu: 0.25

failure_action:
  action: block

This structure has these top-level sections:

  • benchmarks
  • assertions
  • thresholds
  • weights
  • industry_profiles
  • failure_action

Document differences​

CapabilityFull configSingle-policy doc
pack metadatayesno
policies.chainyesno
Multiple policiesyesno
Tests for one standalone policypossibleideal

Validation workflow​

Lint the standalone file with the command that you use for a complete configuration:

verdictan policy lint --file prompt-injection.yaml

Move to a full configuration​

When a complete configuration is necessary, move the policy-specific sections into policy.<kind>. Add a pack object and a policies.chain list:

pack:
  name: example-gateway
  version: 1.0.0
  enabled: true

policies:
  chain:
    - prompt-injection

policy:
  prompt-injection:
    embedding_threshold: 0.8
    response:
      action: block

Next steps​