Shipped Policy Posture

AxonFlow ships a set of policies, and in v11 every one of them is enabled from the first boot. This page lists each shipped policy, its category, the action it takes and on which scopes, and how that action was compiled. It is rendered from the platform's own posture table: the platform derives that table through the activation code that decides which shipped policies run on each scope, and a test in the platform repository fails whenever the table and the shipped policy set differ, so what you read here is what your deployment runs.

The shipped actions observe rather than intervene by default: most policies warn or log, a few redact content that is unambiguously sensitive, and a short list blocks. Every one of them can be disabled, re-enabled or given a different action for your organization; see Policy and Identity Control Plane.

What each action does

Action	What happens when the policy matches
block	The request is refused.
redact	The matched content is masked before it is used or returned.
warn	The request proceeds and the match is recorded and raised as a notification.
log	The request proceeds and the match is recorded on the audit trail.

Where a policy runs

A policy decides only on the scopes that can evaluate it: a scope that never sees a response does not run a response-phase policy, and a scope with no media pipeline does not run the media policies. When a policy bundle is activated, the platform keeps each of its own policies only on the scopes that can evaluate it, and the tables below list the scopes each policy is kept on. Where a policy's action differs by scope, it ships as one engine policy per action, each kept only on the scopes listed for it.

Scope	Kind
cowork_ingest	Enforcement point, gated by edition: it runs only on an edition that includes it.
decide	Enforcement point.
gateway_request	Enforcement point.
map	Enforcement point, gated by configuration: it runs only where it is configured.
mcp:request	Enforcement point.
mcp:response	Enforcement point.
openai_compatible	Enforcement point.
orchestrator_response	Enforcement point.
policy_simulation	Operator tool: it evaluates policies against input an operator supplies, not live traffic.
policy_test	Operator tool: it evaluates policies against input an operator supplies, not live traffic.
proxy_request	Enforcement point.
wcp	Enforcement point.

The last column of each table is the platform's own sentence, generated from the facts its compiler recorded when it compiled each v10.x policy row: where the row's action differs by scope, where the legacy row compiles to different actions on different planes and which one the corpus keeps, where a recorded legacy defect is carried forward rather than silently repaired, and where the row moved to a different policy root. It describes how the shipped policy was compiled, not what v10.x did with a given request.

Platform policies

85 policies, shipped on the platform's own policy root and run by the engine as 116 (a policy whose action differs by scope, or that applies several actions at once, compiles to one engine policy for each): 13 block, 21 redact, 64 warn and 14 log on at least one scope.

Policy	Category	Action and scopes	How it was compiled
sys_dyn_anomalous_access	condition-based	warn on map, policy_simulation, policy_test, wcp	Its compilation reproduces a recorded legacy defect (legacy_dead_condition_field).
sys_dyn_debug_restrict	condition-based	block on map, policy_simulation, policy_test, wcp	Compiled with no recorded divergence.
sys_dyn_expensive_query	condition-based	warn and log, all applied, on map, policy_simulation, policy_test, wcp	Compiled with no recorded divergence.
sys_dyn_financial	condition-based	warn and log, all applied, on map, policy_simulation, policy_test, wcp	Its legacy redaction ships as a warn under the same id, because no scope it binds on can carry a redaction out and there a mandatory redaction would refuse every request it matches.
sys_dyn_gdpr	condition-based	warn and log, all applied, on map, policy_simulation, policy_test, wcp	Its legacy redaction ships as a warn under the same id, because no scope it binds on can carry a redaction out and there a mandatory redaction would refuse every request it matches.
sys_dyn_high_risk_block	condition-based	warn on map, policy_simulation, policy_test, wcp	Compiled with no recorded divergence.
sys_dyn_hipaa	condition-based	warn and log, all applied, on map, policy_simulation, policy_test, wcp	Its legacy redaction ships as a warn under the same id, because no scope it binds on can carry a redaction out and there a mandatory redaction would refuse every request it matches.
sys_dyn_llm_cost	condition-based	warn on map, policy_simulation, policy_test, wcp	Its compilation reproduces a recorded legacy defect (legacy_dead_condition_field).
sys_dyn_sensitive_data	condition-based	warn on map, policy_simulation, policy_test, wcp	Its legacy redaction ships as a warn under the same id, because no scope it binds on can carry a redaction out and there a mandatory redaction would refuse every request it matches.
sys_dyn_tenant_isolation	condition-based	block on map, policy_simulation, policy_test, wcp	Compiled with no recorded divergence.
sys_media_biometric_log	condition-based	log on map, policy_simulation, policy_test, wcp	Compiled with no recorded divergence.
sys_media_nsfw_block	condition-based	block on map, policy_simulation, policy_test, wcp	Compiled with no recorded divergence.
sys_media_pii_block	condition-based	block on map, policy_simulation, policy_test, wcp	Compiled with no recorded divergence.
sys_media_sensitive_doc_warn	condition-based	warn and log, all applied, on map, policy_simulation, policy_test, wcp	Compiled with no recorded divergence.
sys_media_violence_warn	condition-based	warn and log, all applied, on map, policy_simulation, policy_test, wcp	Compiled with no recorded divergence.
sys_admin_audit_log Audit Log Access	security-admin	block on proxy_request log on no scope, so it decides nothing	Its action differs by scope, so it ships as one policy per action (block, log), each kept only on the scopes listed; its compilation reproduces a recorded legacy defect (no_stored_action_for_phase); its log policy corpus:static_policies:sys__admin__audit__log:log is dormant: admitted on no scope; #3323: lifted when the security-admin rename lands (the category admitted on the planes that resolve log for these rows) or the rows are dropped by that cleanup.
sys_admin_config_table Configuration Table Access	security-admin	block on proxy_request log on no scope, so it decides nothing	Its action differs by scope, so it ships as one policy per action (block, log), each kept only on the scopes listed; its compilation reproduces a recorded legacy defect (no_stored_action_for_phase); its log policy corpus:static_policies:sys__admin__config__table:log is dormant: admitted on no scope; #3323: lifted when the security-admin rename lands (the category admitted on the planes that resolve log for these rows) or the rows are dropped by that cleanup.
sys_admin_info_schema Information Schema Access	security-admin	block on proxy_request log on no scope, so it decides nothing	Its action differs by scope, so it ships as one policy per action (block, log), each kept only on the scopes listed; its compilation reproduces a recorded legacy defect (no_stored_action_for_phase); its log policy corpus:static_policies:sys__admin__info__schema:log is dormant: admitted on no scope; #3323: lifted when the security-admin rename lands (the category admitted on the planes that resolve log for these rows) or the rows are dropped by that cleanup.
sys_admin_users_table Users Table Access	security-admin	block on proxy_request log on no scope, so it decides nothing	Its action differs by scope, so it ships as one policy per action (block, log), each kept only on the scopes listed; its compilation reproduces a recorded legacy defect (no_stored_action_for_phase); its log policy corpus:static_policies:sys__admin__users__table:log is dormant: admitted on no scope; #3323: lifted when the security-admin rename lands (the category admitted on the planes that resolve log for these rows) or the rows are dropped by that cleanup.
sys_dangerous_injection_bracket_marker Prompt Injection — Template/Bracket Marker	security-dangerous	block on decide, gateway_request, mcp:request, openai_compatible, proxy_request redact on mcp:response	Its action differs by scope, so it ships as one policy per action (block, redact), each kept only on the scopes listed.
sys_dangerous_injection_override Prompt Injection — Instruction Override	security-dangerous	block on decide, gateway_request, mcp:request, openai_compatible, proxy_request redact on mcp:response	Its action differs by scope, so it ships as one policy per action (block, redact), each kept only on the scopes listed.
sys_dangerous_injection_role_override Prompt Injection — Role Reassignment	security-dangerous	block on decide, gateway_request, mcp:request, openai_compatible, proxy_request redact on mcp:response	Its action differs by scope, so it ships as one policy per action (block, redact), each kept only on the scopes listed.
sys_dangerous_injection_system_exfil Prompt Injection — System Prompt Exfiltration	security-dangerous	block on decide, gateway_request, mcp:request, openai_compatible, proxy_request redact on mcp:response	Its action differs by scope, so it ships as one policy per action (block, redact), each kept only on the scopes listed.
sys_pii_aadhaar Indian Aadhaar Detection	pii-india	redact on cowork_ingest, mcp:response, orchestrator_response warn on decide, gateway_request, mcp:request, openai_compatible, proxy_request	Its action differs by scope, so it ships as one policy per action (redact, warn), each kept only on the scopes listed.
sys_pii_bank_account Bank Account Detection	pii-us	redact on cowork_ingest, mcp:response, orchestrator_response warn on decide, gateway_request, mcp:request, openai_compatible, proxy_request	Its action differs by scope, so it ships as one policy per action (redact, warn), each kept only on the scopes listed.
sys_pii_booking_ref Booking Reference Logging	pii-global	log on decide, gateway_request, mcp:request, mcp:response, openai_compatible, orchestrator_response, proxy_request redact on cowork_ingest	Its action differs by scope, so it ships as one policy per action (log, redact), each kept only on the scopes listed; its compilation reproduces a recorded legacy defect (plane_coerces_stored_action).
sys_pii_credit_card Credit Card Number Detection	pii-global	redact on cowork_ingest, mcp:response, orchestrator_response warn on decide, gateway_request, mcp:request, openai_compatible, proxy_request	Its action differs by scope, so it ships as one policy per action (redact, warn), each kept only on the scopes listed.
sys_pii_dob Date of Birth Detection	pii-global	log on decide, gateway_request, mcp:request, openai_compatible, proxy_request redact on cowork_ingest, mcp:response, orchestrator_response	Its action differs by scope, so it ships as one policy per action (log, redact), each kept only on the scopes listed.
sys_pii_email Email Address Detection	pii-global	log on decide, gateway_request, mcp:request, openai_compatible, proxy_request redact on cowork_ingest, mcp:response, orchestrator_response	Its action differs by scope, so it ships as one policy per action (log, redact), each kept only on the scopes listed.
sys_pii_iban IBAN Detection	pii-eu	redact on cowork_ingest, mcp:response, orchestrator_response warn on decide, gateway_request, mcp:request, openai_compatible, proxy_request	Its action differs by scope, so it ships as one policy per action (redact, warn), each kept only on the scopes listed.
sys_pii_indonesia_ktp Indonesian KTP Detection	pii-indonesia	block on decide, gateway_request, mcp:request, openai_compatible, proxy_request	Compiled with no recorded divergence.
sys_pii_ip_address IP Address Detection	pii-global	log on decide, gateway_request, mcp:request, openai_compatible, proxy_request redact on cowork_ingest, mcp:response, orchestrator_response	Its action differs by scope, so it ships as one policy per action (log, redact), each kept only on the scopes listed.
sys_pii_pan Indian PAN Detection	pii-india	redact on cowork_ingest, mcp:response, orchestrator_response warn on decide, gateway_request, mcp:request, openai_compatible, proxy_request	Its action differs by scope, so it ships as one policy per action (redact, warn), each kept only on the scopes listed.
sys_pii_passport Passport Number Detection	pii-global	log on decide, gateway_request, mcp:request, openai_compatible, proxy_request redact on cowork_ingest, mcp:response, orchestrator_response	Its action differs by scope, so it ships as one policy per action (log, redact), each kept only on the scopes listed.
sys_pii_phone Phone Number Detection	pii-global	log on decide, gateway_request, mcp:request, openai_compatible, proxy_request redact on cowork_ingest, mcp:response, orchestrator_response	Its action differs by scope, so it ships as one policy per action (log, redact), each kept only on the scopes listed.
sys_pii_singapore_fin Singapore FIN Detection	pii-singapore	redact on cowork_ingest, mcp:response, orchestrator_response warn on decide, gateway_request, mcp:request, openai_compatible, proxy_request	Its action differs by scope, so it ships as one policy per action (redact, warn), each kept only on the scopes listed.
sys_pii_singapore_nric Singapore NRIC Detection	pii-singapore	redact on cowork_ingest, mcp:response, orchestrator_response warn on decide, gateway_request, mcp:request, openai_compatible, proxy_request	Its action differs by scope, so it ships as one policy per action (redact, warn), each kept only on the scopes listed.
sys_pii_singapore_phone Singapore Phone Detection	pii-singapore	redact on cowork_ingest, mcp:response, orchestrator_response warn on decide, gateway_request, mcp:request, openai_compatible, proxy_request	Its action differs by scope, so it ships as one policy per action (redact, warn), each kept only on the scopes listed.
sys_pii_singapore_postal Singapore Postal Code Detection	pii-singapore	log on decide, gateway_request, mcp:request, mcp:response, openai_compatible, orchestrator_response, proxy_request redact on cowork_ingest	Its action differs by scope, so it ships as one policy per action (log, redact), each kept only on the scopes listed; its compilation reproduces a recorded legacy defect (plane_coerces_stored_action).
sys_pii_singapore_uen Singapore UEN Detection	pii-singapore	redact on cowork_ingest, mcp:response, orchestrator_response warn on decide, gateway_request, mcp:request, openai_compatible, proxy_request	Its action differs by scope, so it ships as one policy per action (redact, warn), each kept only on the scopes listed.
sys_pii_ssn SSN Detection	pii-us	redact on cowork_ingest, mcp:response, orchestrator_response warn on decide, gateway_request, mcp:request, openai_compatible, proxy_request	Its action differs by scope, so it ships as one policy per action (redact, warn), each kept only on the scopes listed.
sys_sensitive_api_key API Key Detection	sensitive-data	warn on decide, gateway_request, mcp:request, mcp:response, openai_compatible, orchestrator_response, proxy_request	Compiled with no recorded divergence.
sys_sensitive_connection Connection String Detection	sensitive-data	warn on decide, gateway_request, mcp:request, mcp:response, openai_compatible, orchestrator_response, proxy_request	Compiled with no recorded divergence.
sys_sensitive_credentials Credentials Detection	sensitive-data	warn on decide, gateway_request, mcp:request, mcp:response, openai_compatible, orchestrator_response, proxy_request	Compiled with no recorded divergence.
sys_sensitive_password Password Detection	sensitive-data	warn on decide, gateway_request, mcp:request, mcp:response, openai_compatible, orchestrator_response, proxy_request	Compiled with no recorded divergence.
sys_sensitive_secret Secret Detection	sensitive-data	warn on decide, gateway_request, mcp:request, mcp:response, openai_compatible, orchestrator_response, proxy_request	Compiled with no recorded divergence.
sys_sensitive_token Token Detection	sensitive-data	warn on decide, gateway_request, mcp:request, mcp:response, openai_compatible, orchestrator_response, proxy_request	Compiled with no recorded divergence.
sys_sqli_admin_bypass Authentication Bypass	security-sqli	warn on decide, gateway_request, mcp:request, openai_compatible, proxy_request	Compiled with no recorded divergence.
sys_sqli_alter_table ALTER TABLE Statement	security-sqli	warn on decide, gateway_request, mcp:request, openai_compatible, proxy_request	Compiled with no recorded divergence.
sys_sqli_and_false AND False Condition	security-sqli	warn on decide, gateway_request, mcp:request, openai_compatible, proxy_request	Compiled with no recorded divergence.
sys_sqli_benchmark MySQL BENCHMARK Function	security-sqli	warn on decide, gateway_request, mcp:request, openai_compatible, proxy_request	Compiled with no recorded divergence.
sys_sqli_char_function CHAR Function Obfuscation	security-sqli	warn on decide, gateway_request, mcp:request, openai_compatible, proxy_request	Compiled with no recorded divergence.
sys_sqli_concat_select CONCAT with Embedded SELECT	security-sqli	warn on decide, gateway_request, mcp:request, openai_compatible, proxy_request	Compiled with no recorded divergence.
sys_sqli_convert_int CONVERT INT Injection	security-sqli	warn on decide, gateway_request, mcp:request, openai_compatible, proxy_request	Compiled with no recorded divergence.
sys_sqli_create_user CREATE USER Statement	security-sqli	warn on decide, gateway_request, mcp:request, openai_compatible, proxy_request	Compiled with no recorded divergence.
sys_sqli_delete_no_where DELETE Without WHERE	security-sqli	warn on decide, gateway_request, mcp:request, openai_compatible, proxy_request	Compiled with no recorded divergence.
sys_sqli_drop_database DROP DATABASE Statement	security-sqli	warn on decide, gateway_request, mcp:request, openai_compatible, proxy_request	Compiled with no recorded divergence.
sys_sqli_drop_table DROP TABLE Statement	security-sqli	warn on decide, gateway_request, mcp:request, openai_compatible, proxy_request	Compiled with no recorded divergence.
sys_sqli_extractvalue EXTRACTVALUE Function	security-sqli	warn on decide, gateway_request, mcp:request, openai_compatible, proxy_request	Compiled with no recorded divergence.
sys_sqli_grant GRANT Privileges Statement	security-sqli	warn on decide, gateway_request, mcp:request, openai_compatible, proxy_request	Compiled with no recorded divergence.
sys_sqli_hex_encoding Hex-Encoded Payload	security-sqli	warn on decide, gateway_request, mcp:request, openai_compatible, proxy_request	Compiled with no recorded divergence.
sys_sqli_information_schema INFORMATION_SCHEMA Access	security-sqli	warn on decide, gateway_request, mcp:request, openai_compatible, proxy_request	Compiled with no recorded divergence.
sys_sqli_inline_comment Inline Comment Injection	security-sqli	warn on decide, gateway_request, mcp:request, openai_compatible, proxy_request	Compiled with no recorded divergence.
sys_sqli_into_outfile INTO OUTFILE/DUMPFILE	security-sqli	warn on decide, gateway_request, mcp:request, openai_compatible, proxy_request	Compiled with no recorded divergence.
sys_sqli_line_comment_dash Double-Dash Comment Injection	security-sqli	warn on decide, gateway_request, mcp:request, openai_compatible, proxy_request	Compiled with no recorded divergence.
sys_sqli_line_comment_mysql MySQL Line Comment Injection	security-sqli	warn on decide, gateway_request, mcp:request, openai_compatible, proxy_request	Compiled with no recorded divergence.
sys_sqli_load_file LOAD_FILE Function	security-sqli	warn on decide, gateway_request, mcp:request, openai_compatible, proxy_request	Compiled with no recorded divergence.
sys_sqli_or_string OR String Condition	security-sqli	warn on decide, gateway_request, mcp:request, openai_compatible, proxy_request	Compiled with no recorded divergence.
sys_sqli_or_true OR True Condition	security-sqli	warn on decide, gateway_request, mcp:request, openai_compatible, proxy_request	Compiled with no recorded divergence.
sys_sqli_pg_sleep PostgreSQL pg_sleep	security-sqli	warn on decide, gateway_request, mcp:request, openai_compatible, proxy_request	Compiled with no recorded divergence.
sys_sqli_revoke REVOKE Privileges Statement	security-sqli	warn on decide, gateway_request, mcp:request, openai_compatible, proxy_request	Compiled with no recorded divergence.
sys_sqli_select_from SELECT FROM After Termination	security-sqli	warn on decide, gateway_request, mcp:request, openai_compatible, proxy_request	Compiled with no recorded divergence.
sys_sqli_sleep MySQL SLEEP Function	security-sqli	warn on decide, gateway_request, mcp:request, openai_compatible, proxy_request	Compiled with no recorded divergence.
sys_sqli_stacked_delete Stacked DELETE Statement	security-sqli	warn on decide, gateway_request, mcp:request, openai_compatible, proxy_request	Compiled with no recorded divergence.
sys_sqli_stacked_drop Stacked DROP Statement	security-sqli	warn on decide, gateway_request, mcp:request, openai_compatible, proxy_request	Compiled with no recorded divergence.
sys_sqli_stacked_exec Stacked EXEC Statement	security-sqli	warn on decide, gateway_request, mcp:request, openai_compatible, proxy_request	Compiled with no recorded divergence.
sys_sqli_stacked_insert Stacked INSERT Statement	security-sqli	warn on decide, gateway_request, mcp:request, openai_compatible, proxy_request	Compiled with no recorded divergence.
sys_sqli_stacked_update Stacked UPDATE Statement	security-sqli	warn on decide, gateway_request, mcp:request, openai_compatible, proxy_request	Compiled with no recorded divergence.
sys_sqli_string_term_comment String-Terminator Comment Injection	security-sqli	warn on decide, gateway_request, mcp:request, openai_compatible, proxy_request	Compiled with no recorded divergence.
sys_sqli_sys_tables System Tables Access	security-sqli	warn on decide, gateway_request, mcp:request, openai_compatible, proxy_request	Compiled with no recorded divergence.
sys_sqli_truncate TRUNCATE TABLE Statement	security-sqli	warn on decide, gateway_request, mcp:request, openai_compatible, proxy_request	Compiled with no recorded divergence.
sys_sqli_union_injection UNION Injection After Termination	security-sqli	warn on decide, gateway_request, mcp:request, openai_compatible, proxy_request	Compiled with no recorded divergence.
sys_sqli_union_select UNION SELECT Detection	security-sqli	warn on decide, gateway_request, mcp:request, openai_compatible, proxy_request	Compiled with no recorded divergence.
sys_sqli_updatexml UPDATEXML Function	security-sqli	warn on decide, gateway_request, mcp:request, openai_compatible, proxy_request	Compiled with no recorded divergence.
sys_sqli_waitfor SQL Server WAITFOR DELAY	security-sqli	warn on decide, gateway_request, mcp:request, openai_compatible, proxy_request	Compiled with no recorded divergence.

Organization-editable policies

22 policies that v10.x shipped as tenant policies: seeded by AxonFlow and editable by your organization. v11 ships them on your organization's own policy root, so that remains true. They decide from the first boot alongside the platform policies, and a policy document your organization publishes starts from them.

Policy	Category	Action and scopes	How it was compiled
drop_table_prevention DROP TABLE Prevention	dangerous_queries	block on proxy_request	Its compilation reproduces a recorded legacy defect (no_stored_action_for_phase); its legacy row compiles to block and log on different planes and the corpus keeps block; it compiles on the system root and its tier places it on the organization root.
eu_ai_act_high_value_transaction High-Value Transaction Oversight	compliance-euaiact	log on decide, gateway_request, mcp:request, openai_compatible, proxy_request	Its compilation reproduces a recorded legacy defect (no_stored_action_for_phase); it compiles on the system root and its tier places it on the organization root.
eu_ai_act_pricing_fairness Pricing Fairness Validation	compliance-euaiact	log on decide, gateway_request, mcp:request, openai_compatible, proxy_request	Its compilation reproduces a recorded legacy defect (no_stored_action_for_phase); it compiles on the system root and its tier places it on the organization root.
eu_ai_act_sustainability_claims Sustainability Claims Verification	compliance-euaiact	log on decide, gateway_request, mcp:request, openai_compatible, proxy_request	Its compilation reproduces a recorded legacy defect (no_stored_action_for_phase); it compiles on the system root and its tier places it on the organization root.
eu_gdpr_credit_card_detection Credit Card Number PII Detection	pii_detection	redact on no scope, so it decides nothing warn on proxy_request	Its action differs by scope, so it ships as one policy per action (redact, warn), each kept only on the scopes listed; its compilation reproduces a recorded legacy defect (no_stored_action_for_phase); its legacy row compiles to log and redact on different planes and the corpus keeps redact; it redacts on the scopes that can carry a redaction out and warns on the scopes that cannot, where a mandatory redaction would refuse every request it matches; it compiles on the system root and its tier places it on the organization root; its redact policy corpus:static_policies:eu__gdpr__credit__card__detection:redact is dormant: admitted on no scope; becomes live if #4230 canonicalises the category.
eu_gdpr_cross_border_pii Cross-Border PII Minimization	compliance-euaiact	redact on decide, gateway_request, mcp:request warn on openai_compatible, proxy_request	Its action differs by scope, so it ships as one policy per action (redact, warn), each kept only on the scopes listed; its compilation reproduces a recorded legacy defect (no_stored_action_for_phase); its legacy row compiles to log and redact on different planes and the corpus keeps redact; it redacts on the scopes that can carry a redaction out and warns on the scopes that cannot, where a mandatory redaction would refuse every request it matches; it compiles on the system root and its tier places it on the organization root.
eu_gdpr_loyalty_number_detection Loyalty Number PII Detection	pii_detection	redact on no scope, so it decides nothing warn on proxy_request	Its action differs by scope, so it ships as one policy per action (redact, warn), each kept only on the scopes listed; its compilation reproduces a recorded legacy defect (no_stored_action_for_phase); its legacy row compiles to log and redact on different planes and the corpus keeps redact; it redacts on the scopes that can carry a redaction out and warns on the scopes that cannot, where a mandatory redaction would refuse every request it matches; it compiles on the system root and its tier places it on the organization root; its redact policy corpus:static_policies:eu__gdpr__loyalty__number__detection:redact is dormant: admitted on no scope; becomes live if #4230 canonicalises the category.
eu_gdpr_passport_detection Passport Number PII Detection	pii_detection	redact on no scope, so it decides nothing warn on proxy_request	Its action differs by scope, so it ships as one policy per action (redact, warn), each kept only on the scopes listed; its compilation reproduces a recorded legacy defect (no_stored_action_for_phase); its legacy row compiles to log and redact on different planes and the corpus keeps redact; it redacts on the scopes that can carry a redaction out and warns on the scopes that cannot, where a mandatory redaction would refuse every request it matches; it compiles on the system root and its tier places it on the organization root; its redact policy corpus:static_policies:eu__gdpr__passport__detection:redact is dormant: admitted on no scope; becomes live if #4230 canonicalises the category.
pii_ssn_detection SSN Detection	pii_detection	redact on no scope, so it decides nothing warn on proxy_request	Its action differs by scope, so it ships as one policy per action (redact, warn), each kept only on the scopes listed; its compilation reproduces a recorded legacy defect (no_stored_action_for_phase); its legacy row compiles to log and redact on different planes and the corpus keeps redact; it redacts on the scopes that can carry a redaction out and warns on the scopes that cannot, where a mandatory redaction would refuse every request it matches; it compiles on the system root and its tier places it on the organization root; its redact policy corpus:static_policies:pii__ssn__detection:redact is dormant: admitted on no scope; becomes live if #4230 canonicalises the category.
sql_injection_or SQL Injection - OR Condition	sql_injection	block on proxy_request	Its compilation reproduces a recorded legacy defect (no_stored_action_for_phase); its legacy row compiles to block and log on different planes and the corpus keeps block; it compiles on the system root and its tier places it on the organization root.
sql_injection_union SQL Injection - UNION Attack	sql_injection	block on proxy_request	Its compilation reproduces a recorded legacy defect (no_stored_action_for_phase); its legacy row compiles to block and log on different planes and the corpus keeps block; it compiles on the system root and its tier places it on the organization root.
sys_dangerous_agent_config Agent Config File Protection	security-dangerous	block on decide, gateway_request, mcp:request, openai_compatible, proxy_request	It compiles on the system root and its tier places it on the organization root.
sys_dangerous_cloud_metadata Cloud Metadata Endpoint Access	security-dangerous	block on decide, gateway_request, mcp:request, openai_compatible, proxy_request	It compiles on the system root and its tier places it on the organization root.
sys_dangerous_credential_access Credential File Access	security-dangerous	block on decide, gateway_request, mcp:request, openai_compatible, proxy_request	It compiles on the system root and its tier places it on the organization root.
sys_dangerous_destructive_fs Destructive Filesystem Operations	security-dangerous	block on decide, gateway_request, mcp:request, openai_compatible, proxy_request	It compiles on the system root and its tier places it on the organization root.
sys_dangerous_eval_exec Dynamic Code Execution	security-dangerous	block on decide, gateway_request, mcp:request, openai_compatible, proxy_request	It compiles on the system root and its tier places it on the organization root.
sys_dangerous_internal_network Internal Network Access	security-dangerous	block on decide, gateway_request, mcp:request, openai_compatible, proxy_request	It compiles on the system root and its tier places it on the organization root.
sys_dangerous_package_install Unauthorized Package Installation	security-dangerous	block on decide, gateway_request, mcp:request, openai_compatible, proxy_request	It compiles on the system root and its tier places it on the organization root.
sys_dangerous_path_traversal Path Traversal Detection	security-dangerous	block on decide, gateway_request, mcp:request, openai_compatible, proxy_request	It compiles on the system root and its tier places it on the organization root.
sys_dangerous_reverse_shell Reverse Shell Blocking	security-dangerous	block on decide, gateway_request, mcp:request, openai_compatible, proxy_request	It compiles on the system root and its tier places it on the organization root.
sys_dangerous_shell_download Download and Execute	security-dangerous	block on decide, gateway_request, mcp:request, openai_compatible, proxy_request	It compiles on the system root and its tier places it on the organization root.
truncate_prevention TRUNCATE Prevention	dangerous_queries	block on proxy_request	Its compilation reproduces a recorded legacy defect (no_stored_action_for_phase); its legacy row compiles to block and log on different planes and the corpus keeps block; it compiles on the system root and its tier places it on the organization root.

Shipped disabled

9 detectors ship registered and disabled. None of them carries a policy, so none of them decides anything.

Detector	Category	How it was compiled
int_claude_hooks Claude Code Hooks Protection	security-dangerous	No corpus policy is compiled from it (row_excluded_by_legacy_predicate).
int_claude_settings Claude Code Settings Protection	security-dangerous	No corpus policy is compiled from it (row_excluded_by_legacy_predicate).
int_codex_settings Codex Plugin Settings Protection	security-dangerous	No corpus policy is compiled from it (row_excluded_by_legacy_predicate).
int_cursor_hooks Cursor Hooks Protection	security-dangerous	No corpus policy is compiled from it (row_excluded_by_legacy_predicate).
int_cursor_rules Cursor Rules Protection	security-dangerous	No corpus policy is compiled from it (row_excluded_by_legacy_predicate).
int_cursor_settings Cursor Settings Protection	security-dangerous	No corpus policy is compiled from it (row_excluded_by_legacy_predicate).
int_openclaw_agent_identity OpenClaw Agent Identity Protection	security-dangerous	No corpus policy is compiled from it (row_excluded_by_legacy_predicate).
int_openclaw_agent_memory OpenClaw Agent Memory Protection	security-dangerous	No corpus policy is compiled from it (row_excluded_by_legacy_predicate).
int_openclaw_config OpenClaw Config Protection	security-dangerous	No corpus policy is compiled from it (row_excluded_by_legacy_predicate).

Policy packs

None. The platform's table lists no installed policy pack, so every policy on this page is a platform policy or an organization-editable one.

Where this table comes from

The platform derived this table with TestTheShippedPostureArtifactIsDerivedFromTheCorpus (platform/decision/activation/shipped_posture_test.go) at commit c390b3a37dd4, from these inputs. The digest of the platform's own policy document at that commit is sha256:b1da767c46cf210612f5e8aafacf54be344e7def9fed9f34f814c5f8adcbc303.

Input	sha256
platform/decision/legacycompile/legacy_call_sites.tsv	47a00921b31fb25405315ef7a647c8a170739d5919cc795fbe82999bf4f60a34
platform/decision/pdp/system_corpus.json	0ff800e6696d9166a90786f15b9010c94a7efae04abc9d998fed7136bc61651c
platform/decision/registry/detectors_census.tsv	d480155872ccb37eb0bdfa4070d70cd0c285462efd043be486a5800d40de6b85
platform/decision/activation/dormant_template_variants.tsv	6937f4520841a2bba58d5603fa7b34582e5852c6f0963375dc9bf772c4d941ff

Related

• Policy and Identity Control Plane: what decides a request, and what your organization controls.
• System Policies: the detection patterns behind the platform policies.
• Typed Policy Authoring: writing policies of your own.