Policy Rules

Policy Rules is available on eligible Solo and Pro plans where the feature is enabled. Legacy plans keep their existing approval, list, and monitoring features. Legacy subscribers can see Policy Rules and compare plans, but saved rules remain inactive until an eligible plan is verified.

A rule pairs a condition with an action. When an action reaches the rules and the condition matches, the rule decides whether Agent Approve denies it, asks you, or allows it. Rules belong to a policy, and only the active policy's rules are checked.

Order of checks

For each action, the active policy is evaluated in this order:

1. Deny List. A match denies the action.
2. Allow List. A match approves the action.
3. Policy Rules. Enabled rules are checked against the action.
4. Default behavior. Applies when nothing above decided.

A Deny List or Allow List match ends evaluation, so a broad Allow List entry can approve an action before any rule is checked. Policy Rules is an additional check on otherwise undecided actions, not a filter on every action. Review the Allow List before relying on a rule to catch something. Rules are also not checked at all while a policy whose default behavior is Allow All or Deny All is active (see Policies that pause rules).

When several rules match

Deny wins over Ask, and Ask wins over Allow. The order rules appear in the list does not change the outcome, and you cannot reorder rules to change precedence.

An Allow rule applies only when every other enabled rule was checked and did not deny or ask. If any enabled rule cannot be checked, the action is not allowed automatically on the strength of a rule.

An action sent to you because a rule asked for a decision waits for your answer. It is not approved automatically when a veto window expires, even if the policy uses Auto-approve after veto window. See Timeouts and offline fallback.

Policies that pause rules

Allow All and Deny All decide every action by themselves, so no rule is checked and nothing is sent to a rule evaluator while one of them is active. Saved rules and their settings are kept and apply again when you switch to a policy that checks its lists.

Where rules run

Enabled rules are enforced for your whole account by Agent Approve's servers, for every connected computer and agent using Approval Mode. The app edits rules; it does not evaluate them. Older versions of the app keep receiving and approving ordinary requests, but cannot show or edit rules.

The Policy Rules screen

Open the Policy tab and tap Policy Rules in the Lists and Rules section to see the active policy's rules.

• Rules are listed under Enabled Rules and Disabled Rules. Within each section the default order is by decision: Deny rules first, then Ask, then Allow. The More menu (⋯) offers Sort by Decision, Sort by Category, and Sort by Name; the choice is remembered on that device.
• Each row shows the rule's category symbol, its name, its decision as the same icon the Policy tab uses for its lists (a red circle for Deny, a blue question mark for Ask, a green check for Allow), and a chevron that opens the rule. Disabled rules are greyed. A rule is turned on or off from its own screen, or with Enable All and Disable All in the More menu.
• Enable All is unavailable when nothing would change, and it refuses, with a message and no changes, when turning everything on would exceed the enabled-rules limit.
• The search control in the lower right expands to filter the list by name, category, or action.
• Opening a rule shows Edit Rule, top to bottom: name, category, source and the on/off switch; If the agent action with the condition and the match threshold; Then with the decision; Tool command/input must contain; and Remove from Policy at the bottom. Only the on/off switch saves by itself; every other change waits for Save in the top-right corner. While you have unsaved changes the back arrow becomes Cancel, so the choice is always Cancel or Save.
• Source is Library (added from the library), Generated (added by Generate New Rules) or Custom (typed by you). Every rule is fully editable, whatever its source. If you change the name or the condition of a Library or Generated rule, it becomes your own rule: its source changes to Custom, it keeps its decision, match threshold, terms and on/off state, and it no longer follows library updates. Changing only the category, decision, threshold, terms or on/off state never changes the source.
• The category list has a search control in its lower-right corner. Categories cover coding-agent topics, broader domains (healthcare, finance, legal, privacy, monitoring, access control, customers, organization, compliance, and more) and plain verbs.

Tool command/input must contain

Any rule can carry one or more plain text terms. The rule only fires when the tool's command or input contains them (every term with All of these, at least one with Any of these), checked in code before the rule evaluator is asked. There is no pattern language: type the text exactly as it appears, for example a Slack member ID such as U0123ABCD or a repository such as github.com/acme/app. Matching ignores letter case. This is how a rule such as Sends a Slack message to a specific teammate is pinned to one person: the condition is judged by the rule evaluator, and the term makes sure the message really goes to that member ID.

Two library rules need a term before they can be added: Push to a specific repository and Slack message to a specific person. Their screens ask for it.

When the policy has no rules yet, the screen offers Generate New Rules when that option is enabled for your account, plus Browse Library and Create Custom Rule.

Two kinds of rules

Rules with a match threshold need a rule evaluator. Until one is set up and healthy, the rules list shows Rules unavailable: rule evaluator needs attention, those rules count as rules that cannot be checked, and exact-match rules are still checked.

Add rules from the library

1. Open Policy, then Policy Rules.
2. Open the plus menu and tap Add from Library.
3. Choose Rules to browse individual rules by category (each row shows its decision badge), or Rule Sets to add a curated group.
4. Open a rule to read its condition and decision, and to add any text the tool command/input must contain.
5. Tap Add in the top-right corner. It reads Added and stays disabled while the rule is already in the policy. On a rule set, Add All adds every rule the set can add; open a rule in the set to add just that one.

Rules you add are on as soon as they are added. Turn one off from its own screen if you are not ready for it to affect approvals.

The library holds 67 reviewed rules across categories such as files, git, secrets, code execution, network, database, infrastructure, communication, privacy, payments and agent self-control. Rule Sets are starting points: Agentic Coding, Autonomous Agent, Production Operations, Private Workspace, Read-only Research, Protect Secrets, System Safety, Data Safety, Money and Access, People and Privacy, Agent Self-Control, and Trusted Routine (the read-only, test and build steps that need no review). Nothing in the library is on or off. Adding a set copies all of its rules into the policy, turned on; a rule that is already in the policy with the same settings is skipped, and a rule that needs an exact target is skipped until you fill the target in on the set screen. A set is not a second policy: after adding it you manage each rule on its own.

Agent Approve never guesses a repository, member ID or other identifier: you type the text the command or input must contain.

A policy can hold up to 64 saved rules and have up to 16 turned on at once. Get Policy Updates on the Policy page does not change your rules; the library shows a New marker when a rule definition you use has a newer version, and the rule's detail screen offers the update.

Create a custom rule

1. Open the plus menu and tap Create Custom Rule.
2. Choose Deny, Ask, or Allow.
3. On Create Rule, give the rule a name and a category (a topic such as Healthcare or Finance, or a verb such as Delete or Send; the category sets the row icon and can be changed later on any rule, library or custom), and describe one condition in plain English, for example: Posts customer information to a public discussion. Conditions read as a verb phrase; a leading "This action" is removed when the rule is saved.
4. Adjust Match threshold under Advanced if needed.
5. Save it, then turn it on when you are ready.

Custom rules are always checked by the rule evaluator. Custom wording has not been benchmarked, so test a new rule with a harmless action before leaving an agent unattended. A custom Allow must describe the whole action, not just part of it, so that it cannot approve an action that also does something else.

Generate New Rules

Generate New Rules drafts rules from a description you type or dictate. It is part of the Policy Rules beta and must also be enabled for your account.

1. Open the plus menu and tap Generate New Rules.
2. Type what you want, or open Examples while the field is active to drop in a worked example, then tap Generate.
3. The generated rules appear below the description field under Generated rules, each with a selection mark, its category symbol, name, and decision icon. Open one to edit it on the same screen a saved rule has. An identifier you wrote, such as a repository URL or a Slack member ID, becomes that rule's text to match; a rule that needs one and has none says so until you add it.
4. To change the draft, type a follow-up in the same field and tap Refine, or Undo the last change. Deselect a rule to leave it out.
5. Tap Add … Rules to Policy. A generated rule that the policy already holds is not offered.

Nothing is sent when you open the screen. Your description is sent when you tap Generate. What is sent, which providers process it, and how long drafts are kept are described in the Privacy Policy and summarized in Privacy and encryption.

Added rules are on from the start, like any rule you add. The draft is a suggestion for you to review; it does not change or remove any existing rule on its own. A draft expires after 30 minutes without activity. Up to five drafts can be open at once.

Rule Evaluator settings

The Rule Evaluator checks actions against your saved rules. The Rule Generator drafts new rules for you to review. Earlier app versions call the Rule Evaluator Classifier.

Open Settings > Policy Rules > Rule Evaluator. The screen shows the active rule evaluator, connection status, last test, and Connection Details. Below those details, three rows open the settings for Backup provider, If action is too large, and If rules cannot be checked.

Choose a rule evaluator

Tap Rule Evaluator to choose a provider:

Available providers and models may change. The app shows the choices supported for your account.

Open Agent Approve Fast to see its Jev primary and Gemini fallback, including the model configured for each. You can reopen a selected rule evaluator to view its details or change its settings. Agent Approve Fast runs a connection test when you select it. For your own provider:

1. Choose the provider and model.
2. Enter the requested connection details.
3. Save and test the connection.
4. Review the data-sharing information and tap Turn On.

The test sends a small made-up example. Your provider may charge for it. A pass confirms connectivity and the response format; it does not measure accuracy. Unfinished setups expire after 15 minutes.

A provider with several models shows a Model row. Changing the model keeps your saved key and tests the new model before using it. If the test fails, your current model remains selected. Agent Approve chooses the model for Agent Approve Fast.

Keys are stored encrypted and cannot be viewed again. Use Update Key to replace one or Delete Key to remove it. A custom endpoint must accept the supported OpenAI-compatible chat format with structured JSON output. Localhost and private network addresses are not supported.

OpenAI Decisions uses your OpenAI account and its data controls. OpenAI's API data controls list 30-day abuse-monitoring retention by default for Decisions, with Zero Data Retention available only to eligible organizations that have it enabled. Check your own account settings before connecting it. OpenAI does not use API data to train its models by default unless your organization opts in.

Microsoft Decision 1 is available through OpenRouter Decisions as a model choice, including for a backup provider. It uses your OpenRouter API key and the data controls and terms of your OpenRouter account and the selected model's host. It is not part of Agent Approve Fast. Review the provider details before enabling it.

Choosing None disables Policy Rules and stops rule evaluator requests. Your rules stay saved. Choose a rule evaluator again to resume checks, subject to your plan and connection status.

Backup provider

Backup provider is an optional provider connected with your own key. Any supported customer-key provider can be primary or backup. The backup has its own credentials, connection test, and data-sharing consent.

The primary rule evaluator runs first. When it cannot check an action, a configured backup may check it instead. For Agent Approve Fast, this also covers unavailable included credits or capacity. Your provider bills these backup checks directly; they do not spend AI credits.

Google Gemini is part of Agent Approve Fast. It is separate from the backup you configure here. Connection Details and each checked event identify the included processor.

If the backup also cannot check the action, If rules cannot be checked applies, except when its own oversized-action setting specifies a different response. You can remove the backup and its key, or withdraw consent to stop sending checks while retaining its configuration.

If action is too large

Each rule evaluator has an input size limit. Choose what happens when an action exceeds it:

• Use backup sends the full action to an available backup. Agent Approve Fast can use its included larger-action provider. If no usable route can check it, the failure setting applies.
• Ask me requests your approval without sending an oversized check.
• Use Default Behavior applies the active policy's ordinary default behavior.
• Truncate action sends the beginning that fits. The rule evaluator receives a note stating how many bytes of the original action were sent and omitted. Event details identify the partial check.

These choices are independent of If rules cannot be checked. The backup connection has its own oversized-action setting; it cannot route to another backup.

Truncation applies to any action, including commands, edits, file writes, and tool input. It changes only the rule evaluator input, not the action the agent is requesting. Omitted content is not checked. The rule evaluator considers the supplied prefix and truncation note, and normal rule thresholds and decisions still apply, including Allow. Truncation does not guarantee a lower match probability. If even the required context cannot fit, the check fails and your failure setting applies.

If rules cannot be checked

Choose what happens after a timeout, provider error, missing evidence, or exhausted included credits when no backup can complete the check:

• Ask me requests your approval. It does not auto-approve when the wait expires.
• Use Default Behavior applies the active policy's ordinary fallback. If that policy uses an auto-approval window, an unchecked action can be allowed when the window ends.

A rule that already matched as Deny still denies. Exact-match rules can still decide without a rule evaluator. Rules stay saved. To stop a rule from affecting approvals, disable or remove it. No rules are checked when None is selected, your plan does not include Policy Rules, or Allow All or Deny All is active.

AI credits and your own provider

Open Settings > AI Credits to see your allowance, remaining balance, pending usage, and reset date. The usage breakdown shows credits used by Rule Checks and Rule Generator. These are settled charges; pending credits are shown separately. Other appears only when part of the used total has no feature breakdown. Plan & Usage also shows event and active-session limits.

Agent Approve Fast checks and Rule Generator share the included AI-credit allowance. Larger checks and generation can use more credits. Rule-check and generator-turn counts show activity; they are not additional monthly allowances when AI credits are enforced.

Pending credits are reserved for work in progress. Unused reserved credits return when that work settles. Paid credits reset at the beginning of each calendar month at 00:00 UTC. Trial credits are a one-time allowance and do not reset during the trial.

When included credits run out, rule checks use your configured customer-key backup if available, then your failure setting. Rule Generator pauses until credits are available. Saved rules and ordinary manual approvals remain available.

When your balance is nearly exhausted, Plan & Usage and AI Credits show Add Backup Provider (or Manage Backup Provider if one is saved). Paid Solo subscribers also see Upgrade to Pro. The comparison shows both plans' allowances and opens Apple's purchase confirmation with Pro selected. Changing plans does not refill a trial's one-time credits.

Checks using your own provider account spend no Agent Approve AI credits. Your provider's billing, usage limits, and data terms apply. An eligible subscription or trial that includes Policy Rules is still required; your own key does not bypass the plan's event or session limits. Rule Generator uses the included service, even when your rule evaluator uses your own key.

What leaves your device

A rule evaluator receives the current action's tool name and arguments when it reaches a rule check, plus the context enabled for that check. It does not read files from your computer or inspect earlier commands. If you choose truncation, it receives only the supplied prefix and the truncation note. Actions decided by your lists are not sent to the rule evaluator.

Agent Approve Fast uses Agent Approve's TypeSafe account with zero data retention enabled. Its included Gemini route runs under Agent Approve's Google account. TypeSafe states that it does not train or fine-tune on these inputs. Google states that it does not use these requests to improve its products and retains limited logs for abuse detection. These provider practices do not change your event-history retention setting.

Your own provider connection follows your agreement with that provider. OpenRouter also forwards requests to the selected model's host. Review the provider disclosure during setup and the Privacy Policy before enabling a connection.

Rule Generator

Settings > Policy Rules > Rule Generator identifies the providers that draft rules for Generate New Rules. It uses the included AI-credit allowance. It only proposes changes; nothing is added until you tap Add Rules to Policy.

Read a rule check in event details

Open an event to see which rules matched and their match probabilities. Rule Evaluator identifies the provider used for that check. Rule Evaluation Model names its model, separately from the coding agent's model. Rule Evaluation Result shows whether the result was cached, and Rule Evaluation Time shows the recorded check duration in milliseconds. These fields appear when the event includes them.

If a backup checked the action or the input was truncated, the event includes that explanation. AI Credits Used shows the settled charge when available.

What Policy Rules does not do

• It does not check actions your Deny List or Allow List already decided.
• It does not guarantee that any action, including prompt injection or a destructive command, is detected. A rule can miss an action, and a rule evaluator can return a low match probability for an action you would have stopped.
• It does not read files from your computer or look at earlier commands to check a rule. Each check sees the current action only.