Skip to main content

Enterprise Policy Management

Enterprise Feature

The features described on this page require an Enterprise license.

Already an Enterprise customer? Access the full documentation in your Customer Portal.

Enterprise customers have access to advanced policy management capabilities built on AxonFlow's three-tier policy hierarchy.

Enterprise Policy Features​

FeatureCommunityEnterprise
63 System policies (view)✅✅
System policy overrides❌✅
Organization-tier policies❌✅ Full CRUD
Tenant-tier policies✅ 30 limit✅ Unlimited
Policy version history✅ Last 5✅ Full audit trail
Pattern testing API✅✅
Customer Portal UI❌✅

Three-Tier Policy Hierarchy​

┌─────────────────────────────────────────────────────────────┐
│                    SYSTEM POLICIES                          │
│            (Immutable patterns, action overridable)         │
│                  53 static + 10 dynamic                     │
├─────────────────────────────────────────────────────────────┤
│                 ORGANIZATION POLICIES                       │
│              (Company-wide, applies to all tenants)         │
│                   Enterprise only                           │
├─────────────────────────────────────────────────────────────┤
│                    TENANT POLICIES                          │
│               (Team-specific rules)                         │
│          Community: 30 limit | Enterprise: Unlimited        │
└─────────────────────────────────────────────────────────────┘

Organization-Tier Policies​

Organization policies apply to all tenants within your organization. Use them for:

  • Company-wide security standards
  • Shared compliance requirements (HIPAA, PCI-DSS, GDPR)
  • Consistent governance across teams
  • Industry-specific patterns (SWIFT codes, medical IDs)

System Policy Overrides​

While system policy patterns are immutable, Enterprise customers can override their action:

Override TypeDescription
block → warnAllow but flag for review
block → logAllow and audit only
DisableTemporarily disable a system policy

All overrides require a documented reason and can have optional expiration dates for automatic reversion.

Customer Portal​

Enterprise customers access policy management through the Customer Portal:

  • Visual policy editor with pattern testing
  • Tier badges showing policy source (System 🔒, Organization 🏢, Tenant 👥)
  • Override management with audit trail
  • Version history for all changes
  • Import/Export in JSON or YAML format

Policy Templates​

Enterprise includes pre-built policy templates for common compliance and security scenarios. Templates can be applied as-is or customized to fit your organization's requirements.

TemplateDescriptionPolicies Included
HIPAA StarterHealthcare data protectionPHI detection, minimum necessary access, audit logging
PCI-DSSPayment card data securityCredit card detection, PAN masking, access restriction
GDPR PrivacyEU data protectionPII detection, consent checks, right-to-erasure support
Financial ServicesBanking and financeAML patterns, SWIFT code detection, transaction limits
SOC 2 BaselineSecurity and availabilityInput validation, SQL injection blocking, rate limiting

To apply a template via the Customer Portal:

  1. Navigate to Policies > Templates.
  2. Select a template and review the included policies.
  3. Click Apply to add the policies to your organization tier.
  4. Customize individual policies as needed.

Templates can also be applied via the CLI:

axonctl policies apply-template --name "HIPAA Starter" --org your-org-id

Tenant Isolation​

Enterprise policy management enforces strict tenant isolation. Policies are scoped per tenant so that one tenant's rules never affect another.

How Isolation Works​

  • System policies apply globally across all tenants (read-only for tenants, action overridable by org admins).
  • Organization policies apply to all tenants within the organization, set by org administrators.
  • Tenant policies are scoped to a single tenant and only visible/editable by that tenant's administrators.

Isolation Guarantees​

PropertyGuarantee
Policy visibilityTenants can only see their own tenant-tier policies plus system and org policies
Policy creationTenant-created policies are automatically scoped to that tenant
Policy evaluationOnly system + org + the requesting tenant's policies are evaluated per request
Audit logsTenant audit entries are filtered by tenant_id in all queries

Example: Multi-Tenant Policy Evaluation​

When a request arrives for tenant-A, the policy engine evaluates in this order:

  1. System policies (63 built-in patterns) -- applied to all tenants
  2. Organization policies -- company-wide rules set by admins
  3. Tenant-A policies -- only tenant-A's custom rules

Policies from tenant-B are never loaded or evaluated for tenant-A's requests.

Get Enterprise​

Ready to upgrade your policy management capabilities?