Policy Overview

On the Policies page, you can define how AIDR inspects and controls AI traffic.

Each policy type corresponds to a collector category, such as Browser, Falcon Endpoint, Application, Gateway, Agentic, or Logging. You can assign a policy to any

collector registered in your account that matches the policy type. Policy rules report, block, or transform data at different stages of the AI workflow.

Policies determine which detections apply to data flowing through the collector and what actions to enforce.

You can reuse policies across multiple collectors of the same type. When you update a policy, changes apply to all collectors assigned that policy.

You can omit policy assignment entirely and use collectors for logging only.

Pre-configured policies

Pre-configured policies on the Policies page cover common use cases. These policies serve as examples and starting points for your configurations.

To match your security requirements, edit policies or create additional ones.

Create policy

1. On the Policies page, click + Policy.
2. In Create a Policy:
   1. Select a policy type corresponding to a collector category.
   2. Enter a Display name that appears in collector policy selectors.
   3. Review the Policy Key, a unique identifier automatically generated from the display name. AIDR reports the policy key in API responses.
3. Click Save.

AIDR creates the policy and opens its details page.

To return to the policy details page later, click the policy name in the Policies list.

Policy rules

On the policy details page, configure rules across the following tabs.

Site Access

Site access rules are available only in browser collector policies.

Site access rules control what happens when a user visits a monitored website.

AIDR evaluates site access rules first. If AIDR triggers a terminal action, such as Block, Redirect, or Ignore, it stops rule execution and skips further inspection for that site.

For more information, see Site Access Rules.

Inspection Rules

Every policy contains one or more inspection rules. Each inspection rule specifies an event route defined by request attribute conditions. AIDR evaluates inspection rules sequentially and executes the first rule whose event route matches. If no inspection rule matches, AIDR doesn't analyze the request but still logs it.

For each inspection rule, you can configure Access Rules and Prompt Rules.

For more information, see Inspection Rules.

Access Rules

Access rules evaluate request attributes at runtime to allow, block, or report requests. Within a matched inspection rule, AIDR evaluates access rules sequentially. Each rule produces its own result:

• Continue actions proceed to the next rule.
• Stop actions, such as Report and Stop, Block and Stop, and Ignore and Stop, halt rule execution. AIDR doesn't evaluate prompt rules.

tip:

Access rules can execute prompt rules or reference their detection results.

For more information, see Access Rules.

Prompt Rules

Prompt rules apply detectors to content exchanged with the AI system. If no access rule stops execution, AIDR applies enabled prompt rules within the matched inspection rule:

• AIDR runs configured detectors on the content.
• AIDR applies actions defined in the detectors: block, report, or detector rule-specific actions.

For more information, see Prompt Rules.

View policy audit log

On the policy details page, you can view policy configuration changes in the Audit Log tab. For more information, see Audit Log.

Manage policy options

Click the menu icon in the policy list or on the policy details page to access the following options:

• Clone - Create a copy of the policy.
• Rename - Edit the policy name. Available for custom policies and modified pre-configured policies.
• Delete - Remove or reset policies:
  • For a policy you created - Delete the policy.
  • For a pre-configured policy - Reset the policy to its default configuration.