Data Governance Policies

A policy defines which detectors matter, where the policy applies, and what the gateway does when it finds a match. This page covers creating policies, choosing an enforcement mode, adding exceptions, and attaching a policy to an Agent Persona.

Create a policy

Open Data Governance → Policies, stay on the Policies tab, and select New Policy. The policy wizard has three steps.

Step 1: Select MCP servers

Choose one or more MCP servers where the policy applies.

You can:

• Search by server name or description
• Filter production and non-production servers
• Sort by name or creation date
• Select or clear all visible servers

At least one server is required when creating a policy from the Policies page. (To scope a policy to an agent instead, create it from the persona — see Attach policies to an Agent Persona.)

Step 2: Select data categories and detectors

Choose one or more detector groups or individual detectors. The policy evaluates traffic for any sensitive data represented by the selected criteria.

Start with the smallest set that satisfies the policy's purpose. Narrow policies are easier to test, investigate, and tune than a single policy covering every detector.

Step 3: Configure enforcement

Choose an enforcement mode, enter a policy name, and optionally add a description and exceptions.

A policy must have:

• At least one selected MCP server
• At least one detector or detector group
• A name

Select Create Policy to activate it.

Choose an enforcement mode

Mode	What happens	Recommended use
Monitor	Records the finding and allows traffic to continue unchanged	Baselines, new policies, and false-positive analysis
Redact	Masks matched sensitive data before the traffic continues	Workflows that can proceed without the original value
Block	Stops traffic containing the governed data	High-risk data that must not cross the boundary

Start new policies in Monitor. After reviewing real findings and adding necessary exceptions, move the policy to Redact or Block.

Add policy exceptions

Exceptions suppress known-safe matches without disabling the underlying detector for all traffic.

Use exceptions for narrowly defined cases, such as:

• Approved test values
• Known examples or documentation content
• A detector that should be ignored on one selected server

Keep exceptions specific. Broad exclusions can create gaps that are difficult to see from policy status alone.

Manage existing policies

The Policies table shows each policy's status, name and description, action, scope, and detectors.

Use the search and filters to narrow by detector, Agent Persona, MCP server, or action. Expand a row to see its details.

Security administrators can:

• Enable or disable a policy
• Edit its servers, detectors, action, name, description, and exceptions
• Delete a policy

Deleting a policy permanently removes it and its associated suppressions.

---

Attach Policies to an Agent Persona

A persona-scoped policy follows an Agent Persona across every tool, API, and model it calls. This is useful when the protection requirement belongs to the agent's purpose rather than to one MCP server.

To attach a policy:

1. Open Agent Personas and select a persona.
2. Open its Configuration tab.
3. Select Data Governance.
4. Select Attach Policy or Update Policies.
5. Choose existing policies, or create a new policy in the same flow.
6. Save your changes.

When you create a policy from an Agent Persona, the server-selection step is omitted. The persona itself is the scope, and the policy is enforced wherever that persona operates.

The persona page manages attachment. To edit, enable, disable, or delete the policy definition, use Data Governance → Policies.