System Policies Reference

Reference page. This is the canonical inventory of every built-in policy, its category, and its default action. Use it to look up what ships out of the box before you write a custom policy. New to policies? Start with Policy-as-Code and Policy Hierarchy.

AxonFlow ships with 79 built-in system policies:

69 pattern-based system policies evaluated by the Agent for low-latency enforcement
10 condition-based system policies evaluated by the Orchestrator for context-aware governance

These policies give engineers a strong production baseline for LLM security, PII protection, prompt-injection defense, secret detection, and runtime compliance controls.

System policies are immutable (tier=system) — you cannot edit or delete them, but Enterprise customers can override their action or disable them per organization (see Customizing System Policies).

Actions are governance-profile-driven

The Action column below is the default profile action — the out-of-the-box posture (ADR-036, v6.2.0+). In the default profile, SQL injection, PII, and sensitive-data detections warn (the request flows through unchanged but the detection is recorded), while the unambiguously dangerous classes block: admin-table access, Indonesian KTP, and prompt-injection ship as block. Singapore PII ships as redact.

This is deliberate (observe-first): false positives that hard-block legitimate traffic teach users to bypass the system. To harden enforcement, switch profiles or set per-category env vars — e.g. AXONFLOW_PROFILE=strict makes PII/SQLi/sensitive-data block, and PII_ACTION=redact / SQLI_ACTION=block flip individual categories. See Governance Profiles for the full dev / default / strict / compliance matrix. Enterprise customers can additionally override any single policy's action per organization.

Overview

Category	Evaluation	Count	Severity Range	Default Action
Security - SQL Injection (`security-sqli`)	Pattern-Based (Agent)	37	Critical - Medium	Warn
Security - Admin Access (`security-admin`)	Pattern-Based (Agent)	4	High - Medium	Block
Security - Dangerous Instructions (`security-dangerous`)	Pattern-Based (Agent)	4	High	Block
Sensitive Data / Secrets (`sensitive-data`)	Pattern-Based (Agent)	6	High	Warn
PII - Global (`pii-global`)	Pattern-Based (Agent)	7	Critical - Low	Warn / Log
PII - United States (`pii-us`)	Pattern-Based (Agent)	2	Critical	Warn
PII - European Union (`pii-eu`)	Pattern-Based (Agent)	1	Critical	Warn
PII - India (`pii-india`)	Pattern-Based (Agent)	2	Critical	Warn
PII - Singapore (`pii-singapore`)	Pattern-Based (Agent)	5	Critical - Low	Redact
PII - Indonesia (`pii-indonesia`)	Pattern-Based (Agent)	1	Critical	Block
Risk Management (`dynamic-risk`)	Condition-Based (Orchestrator)	2	-	Block / Warn
Compliance (`dynamic-compliance`)	Condition-Based (Orchestrator)	3	-	Block
Security Controls (`dynamic-security`)	Condition-Based (Orchestrator)	2	-	Block
Cost Management (`dynamic-cost`)	Condition-Based (Orchestrator)	2	-	Block / Warn
Access Control (`dynamic-access`)	Condition-Based (Orchestrator)	1	-	Block

Pattern-based total: 69 · Condition-based total: 10 · All system policies: 79.

"Secret/unsafe-code" detection

Generic secret detection (API keys, tokens, passwords, connection strings) ships as the sensitive-data category below. Language-specific code secret/unsafe patterns (e.g. provider-specific API-key formats, eval()/pickle) are surfaced today only as audit metadata on generated-code responses, not as enforced policies. Enforced agent-traffic code-secret/unsafe-code detection is tracked as potential net-new work, not a shipped system policy.

Pattern-Based System Policies

Security - SQL Injection (`security-sqli`)

37 patterns covering all major SQL injection techniques.

UNION-Based Injection (2 patterns)

ID	Name	Severity	Action
`sys_sqli_union_select`	UNION SELECT Detection	Critical	Warn
`sys_sqli_union_injection`	UNION Injection After Termination	Critical	Warn

ID	Name	Severity	Action
`sys_sqli_or_true`	OR True Condition	High	Warn
`sys_sqli_or_string`	OR String Condition	High	Warn
`sys_sqli_and_false`	AND False Condition	High	Warn

ID	Name	Severity	Action
`sys_sqli_sleep`	MySQL SLEEP Function	Critical	Warn
`sys_sqli_waitfor`	SQL Server WAITFOR DELAY	Critical	Warn
`sys_sqli_pg_sleep`	PostgreSQL pg_sleep	Critical	Warn
`sys_sqli_benchmark`	MySQL BENCHMARK Function	Critical	Warn

Error-Based Injection (3 patterns)

ID	Name	Severity	Action
`sys_sqli_extractvalue`	EXTRACTVALUE Function	High	Warn
`sys_sqli_updatexml`	UPDATEXML Function	High	Warn
`sys_sqli_convert_int`	CONVERT INT Injection	High	Warn

Stacked Queries (5 patterns)

ID	Name	Severity	Action
`sys_sqli_stacked_drop`	Stacked DROP Statement	Critical	Warn
`sys_sqli_stacked_delete`	Stacked DELETE Statement	Critical	Warn
`sys_sqli_stacked_update`	Stacked UPDATE Statement	Critical	Warn
`sys_sqli_stacked_insert`	Stacked INSERT Statement	Critical	Warn
`sys_sqli_stacked_exec`	Stacked EXEC Statement	Critical	Warn

Comment-Based Injection (3 patterns)

ID	Name	Severity	Action
`sys_sqli_inline_comment`	Inline Comment Injection	High	Warn
`sys_sqli_line_comment_mysql`	MySQL Line Comment Injection	High	Warn
`sys_sqli_line_comment_dash`	Double-Dash Comment Injection	High	Warn

Generic Patterns (9 patterns)

ID	Name	Severity	Action
`sys_sqli_select_from`	SELECT FROM After Termination	Critical	Warn
`sys_sqli_admin_bypass`	Authentication Bypass	Critical	Warn
`sys_sqli_hex_encoding`	Hex-Encoded Payload	Medium	Warn
`sys_sqli_char_function`	CHAR Function Obfuscation	High	Warn
`sys_sqli_concat_select`	CONCAT with Embedded SELECT	High	Warn
`sys_sqli_information_schema`	INFORMATION_SCHEMA Access	High	Warn
`sys_sqli_sys_tables`	System Tables Access	High	Warn
`sys_sqli_load_file`	LOAD_FILE Function	Critical	Warn
`sys_sqli_into_outfile`	INTO OUTFILE/DUMPFILE	Critical	Warn

Dangerous Query Patterns (8 patterns)

ID	Name	Severity	Action
`sys_sqli_drop_table`	DROP TABLE Statement	Critical	Warn
`sys_sqli_drop_database`	DROP DATABASE Statement	Critical	Warn
`sys_sqli_truncate`	TRUNCATE TABLE Statement	Critical	Warn
`sys_sqli_alter_table`	ALTER TABLE Statement	High	Warn
`sys_sqli_delete_no_where`	DELETE Without WHERE	Critical	Warn
`sys_sqli_create_user`	CREATE USER Statement	Critical	Warn
`sys_sqli_grant`	GRANT Privileges Statement	Critical	Warn
`sys_sqli_revoke`	REVOKE Privileges Statement	Critical	Warn

Security - Admin Access (`security-admin`)

4 patterns guarding access to sensitive administrative tables and schemas.

ID	Name	Severity	Action	Description
`sys_admin_users_table`	Users Table Access	High	Block	Access to users table
`sys_admin_audit_log`	Audit Log Access	High	Block	Access to audit logs
`sys_admin_config_table`	Configuration Table Access	High	Block	System config access
`sys_admin_info_schema`	Information Schema Access	Medium	Block	System schema access

Security - Dangerous Instructions (`security-dangerous`)

4 patterns detecting indirect prompt-injection attempts in free-text that flows into the model (OWASP LLM01). These guard merchant/user-controlled fields and ship as block.

ID	Name	Severity	Action	Description
`sys_dangerous_injection_override`	Prompt Injection — Instruction Override	High	Block	"Ignore/disregard previous instructions" and similar overrides
`sys_dangerous_injection_role_override`	Prompt Injection — Role Reassignment	High	Block	Attempts to reassign the assistant to a privileged/jailbreak persona
`sys_dangerous_injection_system_exfil`	Prompt Injection — System Prompt Exfiltration	High	Block	Attempts to reveal/print/repeat the system prompt or hidden instructions
`sys_dangerous_injection_bracket_marker`	Prompt Injection — Template/Bracket Marker	High	Block	Injected chat-template/role-delimiter markers (`[system]`, `<im_start>`, `### system`)

Sensitive Data / Secrets (`sensitive-data`)

6 patterns detecting credentials and secrets in request/response content (generic, provider-agnostic).

ID	Name	Severity	Action	Description
`sys_sensitive_api_key`	API Key Detection	High	Warn	Generic API-key assignment patterns
`sys_sensitive_token`	Token Detection	High	Warn	Bearer/access tokens in content
`sys_sensitive_secret`	Secret Detection	High	Warn	Generic secret assignment patterns
`sys_sensitive_password`	Password Detection	High	Warn	Password values in content
`sys_sensitive_credentials`	Credentials Detection	High	Warn	Combined credential patterns
`sys_sensitive_connection`	Connection String Detection	High	Warn	Database/service connection strings

PII - Global (`pii-global`)

7 universal patterns applicable in all regions.

ID	Name	Severity	Action	Description
`sys_pii_credit_card`	Credit Card Number	Critical	Warn	Visa, MC, Amex, Discover, Diners, JCB
`sys_pii_passport`	Passport Number	High	Warn	Generic passport format
`sys_pii_dob`	Date of Birth	High	Log	Common date formats
`sys_pii_email`	Email Address	Medium	Log	Standard email format
`sys_pii_phone`	Phone Number	Medium	Log	International formats
`sys_pii_ip_address`	IP Address	Medium	Log	IPv4 addresses
`sys_pii_booking_ref`	Booking Reference	Low	Log	Context-anchored 6-char alphanumeric

PII - United States (`pii-us`)

ID	Name	Severity	Action	Description
`sys_pii_ssn`	Social Security Number	Critical	Warn	XXX-XX-XXXX format
`sys_pii_bank_account`	Bank Account Number	Critical	Warn	Routing + account number

PII - European Union (`pii-eu`)

ID	Name	Severity	Action	Description
`sys_pii_iban`	IBAN	Critical	Warn	International Bank Account Number

PII - India (`pii-india`)

ID	Name	Severity	Action	Description
`sys_pii_pan`	PAN (Permanent Account Number)	Critical	Warn	10-char with entity-type validation
`sys_pii_aadhaar`	Aadhaar Number	Critical	Warn	12-digit UID (DPDP Act 2023)

PII - Singapore (`pii-singapore`)

Singapore-specific patterns support MAS FEAT-oriented governance and regional privacy controls in Community Edition. These ship as redact.

ID	Name	Severity	Action	Description
`sys_pii_singapore_nric`	Singapore NRIC Detection	Critical	Redact	National Registration Identity Card pattern
`sys_pii_singapore_fin`	Singapore FIN Detection	Critical	Redact	Foreign Identification Number pattern
`sys_pii_singapore_uen`	Singapore UEN Detection	High	Redact	Unique Entity Number pattern
`sys_pii_singapore_phone`	Singapore Phone Detection	Medium	Redact	`+65` phone numbers
`sys_pii_singapore_postal`	Singapore Postal Code Detection	Low	Warn	Six-digit postal code pattern

PII - Indonesia (`pii-indonesia`)

Indonesia KTP/NIK detection for OJK / BI / UU PDP compliance. The Community shared engine seeds the KTP menu entry as block; the Enterprise Indonesia PII detector additionally enforces NIK, NPWP, phone, and major-bank account patterns at runtime with NIK validation.

ID	Name	Severity	Action	Description
`sys_pii_indonesia_ktp`	Indonesian KTP Detection	Critical	Block	16-digit KTP/NIK (keyword-anchored, NIK-validated)

Condition-Based System Policies

Condition-based policies use context-aware rules evaluated by the Orchestrator. These provide runtime governance for risk, compliance, cost, and access control.

Policy ID Naming Convention

System policy IDs follow the pattern: sys_ + category abbreviation + specific pattern name.

Prefix	Meaning	Example
`sys_sqli_`	SQL injection pattern	`sys_sqli_union_select`
`sys_admin_`	Admin access control	`sys_admin_users_table`
`sys_dangerous_`	Prompt-injection guard	`sys_dangerous_injection_override`
`sys_sensitive_`	Secret / sensitive-data pattern	`sys_sensitive_api_key`
`sys_pii_`	PII detection pattern	`sys_pii_ssn`
`sys_dyn_`	Dynamic/condition-based policy	`sys_dyn_high_risk_block`

Risk Management (`dynamic-risk`)

ID	Name	Condition	Action
`sys_dyn_high_risk_block`	Block High-Risk Queries	`risk_score > 0.8`	Block
`sys_dyn_anomalous_access`	Anomalous Access Detection	`risk_score > 0.6` and anomalous access pattern	Alert

Condition example (as returned by GET /api/v1/policies):

{
  "id": "sys_dyn_high_risk_block",
  "name": "Block High-Risk Queries",
  "type": "risk_based",
  "category": "dynamic-risk",
  "tier": "system",
  "conditions": [
    {"field": "risk_score", "operator": "greater_than", "value": 0.8}
  ],
  "actions": [
    {"type": "block", "config": {"reason": "Query risk score exceeds safety threshold"}}
  ],
  "enabled": true
}

Compliance (`dynamic-compliance`)

ID	Name	Condition	Action
`sys_dyn_hipaa`	HIPAA Compliance	Healthcare data keywords present	Redact + Log
`sys_dyn_gdpr`	GDPR Compliance	User region in EU/EEA/UK	Redact + Log
`sys_dyn_financial`	Financial Data Protection	Financial data keywords present	Redact + Log

Condition example (as returned by GET /api/v1/policies):

{
  "id": "sys_dyn_hipaa",
  "name": "HIPAA Compliance",
  "type": "compliance",
  "category": "dynamic-compliance",
  "tier": "system",
  "conditions": [
    {"field": "query", "operator": "contains_any", "value": ["patient", "diagnosis", "treatment", "medical_record", "prescription"]}
  ],
  "actions": [
    {"type": "redact", "config": {"fields": ["patient_id", "ssn", "medical_record_number"]}},
    {"type": "log", "config": {"compliance": "hipaa"}}
  ],
  "enabled": true
}

Security Controls (`dynamic-security`)

ID	Name	Condition	Action
`sys_dyn_tenant_isolation`	Tenant Isolation	Cross-tenant `tenant_id` access attempt	Block
`sys_dyn_debug_restrict`	Debug Mode Restriction	`debug` query outside `development` environment	Block

Cost Management (`dynamic-cost`)

ID	Name	Condition	Action
`sys_dyn_expensive_query`	Expensive Query Limit	`cost_estimate > 100`	Alert + Log
`sys_dyn_llm_cost`	LLM Cost Optimization	LLM chat and `monthly_llm_usage > 1000`	Add risk + Alert

Access Control (`dynamic-access`)

ID	Name	Condition	Action
`sys_dyn_sensitive_data`	Sensitive Data Control	Query references salary, SSN, or medical records	Redact

Querying System Policies

List All System Policies

const policies = await client.listStaticPolicies({
  tier: 'system'
});

console.log(`Total system policies: ${policies.length}`);

Filter by Category

// Get all SQL injection policies
const sqli = await client.listStaticPolicies({
  tier: 'system',
  category: 'security-sqli'
});

// Get all PII policies
const pii = await client.listStaticPolicies({
  tier: 'system',
  category: 'pii-global'
});

REST API

# All system policies
curl "http://localhost:8080/api/v1/static-policies?tier=system"

# Filtered by category
curl "http://localhost:8080/api/v1/static-policies?tier=system&category=security-sqli"

Customizing System Policies (Enterprise)

Enterprise Feature

Policy overrides require an Enterprise license.

You cannot modify system policy patterns, but you can:

Disable a policy for your organization
Change the action (only to more restrictive, or disable)
Set an expiration for temporary overrides

Example: Disable Email Detection

await client.createPolicyOverride({
  policyId: 'sys_pii_email',
  enabledOverride: false,
  overrideReason: 'Internal tool - no customer email exposure',
});

Example: Escalate to Block

await client.createPolicyOverride({
  policyId: 'sys_pii_credit_card',
  actionOverride: 'block',  // Was 'warn'
  overrideReason: 'PCI requirement - block all credit-card exposure',
});

Policy Hierarchy - Understanding tier inheritance
SDK Methods - Full API reference
Policy Testing - Test patterns before deployment

Rollout Checklist

Use this page as one layer of the broader governance rollout:

decide where the rule belongs with Policy Hierarchy
test the request path with Runtime Request Paths
connect review workflows to HITL Approval Gates when a block should become a human decision
compare Community vs Evaluation vs Enterprise when simulation, evidence export, SSO, SCIM, or portal operations become requirements

System Policies Reference

Overview

Pattern-Based System Policies

Security - SQL Injection (`security-sqli`)

UNION-Based Injection (2 patterns)

Boolean-Based Blind Injection (3 patterns)

Time-Based Blind Injection (4 patterns)

Error-Based Injection (3 patterns)

Stacked Queries (5 patterns)

Comment-Based Injection (3 patterns)

Generic Patterns (9 patterns)

Dangerous Query Patterns (8 patterns)

Security - Admin Access (`security-admin`)

Security - Dangerous Instructions (`security-dangerous`)

Sensitive Data / Secrets (`sensitive-data`)

PII - Global (`pii-global`)

PII - United States (`pii-us`)

PII - European Union (`pii-eu`)

PII - India (`pii-india`)

PII - Singapore (`pii-singapore`)

PII - Indonesia (`pii-indonesia`)

Condition-Based System Policies

Policy ID Naming Convention

Risk Management (`dynamic-risk`)

Compliance (`dynamic-compliance`)

Security Controls (`dynamic-security`)

Cost Management (`dynamic-cost`)

Access Control (`dynamic-access`)

Querying System Policies

List All System Policies

Filter by Category

REST API

Customizing System Policies (Enterprise)

Example: Disable Email Detection

Example: Escalate to Block

Rollout Checklist

Overview​

Pattern-Based System Policies​

Security - SQL Injection (security-sqli)​

UNION-Based Injection (2 patterns)​

Boolean-Based Blind Injection (3 patterns)​

Time-Based Blind Injection (4 patterns)​

Error-Based Injection (3 patterns)​

Stacked Queries (5 patterns)​

Comment-Based Injection (3 patterns)​

Generic Patterns (9 patterns)​

Dangerous Query Patterns (8 patterns)​

Security - Admin Access (security-admin)​

Security - Dangerous Instructions (security-dangerous)​

Sensitive Data / Secrets (sensitive-data)​

PII - Global (pii-global)​

PII - United States (pii-us)​

PII - European Union (pii-eu)​

PII - India (pii-india)​

PII - Singapore (pii-singapore)​

PII - Indonesia (pii-indonesia)​

Condition-Based System Policies​

Policy ID Naming Convention​

Risk Management (dynamic-risk)​

Compliance (dynamic-compliance)​

Security Controls (dynamic-security)​

Cost Management (dynamic-cost)​

Access Control (dynamic-access)​

Querying System Policies​

List All System Policies​

Filter by Category​

REST API​

Customizing System Policies (Enterprise)​

Example: Disable Email Detection​

Example: Escalate to Block​

Related​

Rollout Checklist​

Overview

Pattern-Based System Policies

Security - SQL Injection (`security-sqli`)

UNION-Based Injection (2 patterns)

Boolean-Based Blind Injection (3 patterns)

Time-Based Blind Injection (4 patterns)

Error-Based Injection (3 patterns)

Stacked Queries (5 patterns)

Comment-Based Injection (3 patterns)

Generic Patterns (9 patterns)

Dangerous Query Patterns (8 patterns)

Security - Admin Access (`security-admin`)

Security - Dangerous Instructions (`security-dangerous`)

Sensitive Data / Secrets (`sensitive-data`)

PII - Global (`pii-global`)

PII - United States (`pii-us`)

PII - European Union (`pii-eu`)

PII - India (`pii-india`)

PII - Singapore (`pii-singapore`)

PII - Indonesia (`pii-indonesia`)

Condition-Based System Policies

Policy ID Naming Convention

Risk Management (`dynamic-risk`)

Compliance (`dynamic-compliance`)

Security Controls (`dynamic-security`)

Cost Management (`dynamic-cost`)

Access Control (`dynamic-access`)

Querying System Policies

List All System Policies

Filter by Category

REST API

Customizing System Policies (Enterprise)

Example: Disable Email Detection

Example: Escalate to Block

Related

Rollout Checklist