System Policies Reference

Reference page. This is the canonical inventory of every built-in policy, its category, and its default action. Use it to look up what ships out of the box before you write a custom policy. New to policies? Start with Policy-as-Code and Policy Hierarchy.

AxonFlow ships with 85 built-in system policies:

• 70 pattern-based system policies evaluated by the Agent for low-latency enforcement
• 15 condition-based system policies evaluated by the Orchestrator for context-aware governance

These policies give engineers a strong production baseline for LLM security, PII protection, prompt-injection defense, secret detection, and runtime compliance controls.

System policies are immutable (tier=system) - you cannot edit or delete them, but in v11 every edition can disable, re-enable or re-action each one for an organization (see Customizing System Policies).

The Action column is the stored action

The Action column below is the action stored on the policy row as shipped - the out-of-the-box posture (ADR-036, v6.2.0+). Out of the box, SQL injection, PII, and sensitive-data detections warn (the request flows through unchanged but the detection is recorded), while the unambiguously dangerous classes block: admin-table access, Indonesian KTP, and prompt-injection ship as block. Singapore PII ships as redact.

This is deliberate (observe-first): false positives that hard-block legitimate traffic teach users to bypass the system. To harden enforcement, record an organization detection-posture override for the category (for example pii=block or sqli=block), or change that one policy for your organization: in v11 every edition can disable, re-enable or re-action a shipped policy, while the v10.x tenant-policy write routes answer 409 LEGACY_POLICY_WRITE_FROZEN. Since v11 no environment variable or profile sets an action: AXONFLOW_PROFILE and the *_ACTION variables are ignored with a boot warning (see Governance Profiles (removed in v11)).

For detection categories the stored action decides unless the organization records an override for that category. What the Action column means at runtime has the per-plane matrix and the resolution order.

Overview

Category	Evaluation	Count	Severity Range	Default Action
Security - SQL Injection (security-sqli)	Pattern-Based (Agent)	38	Critical - Medium	Warn
Security - Admin Access (security-admin)	Pattern-Based (Agent)	4	High - Medium	Block
Security - Dangerous Instructions (security-dangerous)	Pattern-Based (Agent)	4	High	Block
Sensitive Data / Secrets (sensitive-data)	Pattern-Based (Agent)	6	High	Warn
PII - Global (pii-global)	Pattern-Based (Agent)	7	Critical - Low	Warn / Log
PII - United States (pii-us)	Pattern-Based (Agent)	2	Critical	Warn
PII - European Union (pii-eu)	Pattern-Based (Agent)	1	Critical	Warn
PII - India (pii-india)	Pattern-Based (Agent)	2	Critical	Warn
PII - Singapore (pii-singapore)	Pattern-Based (Agent)	5	Critical - Low	Redact
PII - Indonesia (pii-indonesia)	Pattern-Based (Agent)	1	Critical	Block
Risk Management (dynamic-risk)	Condition-Based (Orchestrator)	2	-	Warn / Alert
Compliance (dynamic-compliance)	Condition-Based (Orchestrator)	3	-	Block
Security Controls (dynamic-security)	Condition-Based (Orchestrator)	2	-	Block
Cost Management (dynamic-cost)	Condition-Based (Orchestrator)	2	-	Block / Warn
Access Control (dynamic-access)	Condition-Based (Orchestrator)	1	-	Block
Media Safety (media-safety)	Condition-Based (Orchestrator)	2	-	Block / Alert
Media Biometric (media-biometric)	Condition-Based (Orchestrator)	1	-	Log
Media PII (media-pii)	Condition-Based (Orchestrator)	1	-	Block
Media Document (media-document)	Condition-Based (Orchestrator)	1	-	Alert + Log

Pattern-based total: 70 · Condition-based total: 15 · All system policies: 85.

"Secret/unsafe-code" detection

Generic secret detection (API keys, tokens, passwords, connection strings) ships as the sensitive-data category below. Language-specific code secret/unsafe patterns (e.g. provider-specific API-key formats, eval()/pickle) are surfaced today only as audit metadata on generated-code responses, not as enforced policies. Enforced agent-traffic code-secret/unsafe-code detection is tracked as potential net-new work, not a shipped system policy.

---

What the Action column means at runtime

The Action column in the tables on this page is the action each policy is seeded with. In v11 the platform compiles these rows into the policies its decision engine runs, and the action each one takes on each plane is listed in Shipped Policy Posture. For the three detection categories (pii-*, security-sqli, security-dangerous), an organization's recorded detection-posture override replaces it on the platform's policies, and any shipped policy's action can be changed for a single organization. No environment variable or profile takes part.

An organization override replaces the stored action for the platform's policies in the category

A pii-* row that stores block denies on the decision API, gateway, MCP, and OpenAI-compatible planes unless the organization has recorded a weaker pii override, which then governs every platform pii-* policy for that organization. If a compliance requirement says a category must hard-deny, keep the row's block and do not record a weaker override, or record block for the category.

sensitive-data, the compliance categories (compliance-*, fincrime) and admin-access have no override category. Their shipped action decides unless your organization changes the policy itself.

Resolution order

The effective action for a detection category resolves in this order, first match wins:

1. Per-org detection override, set through Detection Posture (the portal write path is Enterprise; the enforcement planes honor overrides in both editions). pii reaches the 18 platform pii-* policies, sqli the 38 platform security-sqli policies, and dangerous_command the four platform policies in security-dangerous, which are the indirect prompt-injection guards; dangerous_query maps onto no policy category, and the 22 organization-editable policies are not reached.
2. The shipped action of the matched policy on the plane being decided, as listed in Shipped Policy Posture. A policy your organization has changed decides with the action you set.

The environment variables that used to sit between these two (PII_ACTION, SQLI_ACTION, SENSITIVE_DATA_ACTION, DANGEROUS_COMMAND_ACTION, their GATEWAY_* / MCP_* variants, and the AXONFLOW_PROFILE defaults) were removed in v11 and are ignored with a boot warning. See Environment Variables Reference.

What each plane does with an action

Each plane renders the resolved action in its own wire shape:

Plane	block	redact	warn / log
Decision API (POST /api/v1/decide)	deny	allow plus a redact_pii obligation	allow, recorded
Gateway pre-check	approved=false	allow plus requires_redaction (masking is the caller-side contract)	allow, recorded
MCP check-input / check_policy	allowed=false	allowed, with the statement masked	allowed
MCP tools/execute, resources/query	HTTP 403	refused (unsupported_obligation): this surface cannot mask the request	recorded only
OpenAI-compatible (/v1/chat/completions)	HTTP 400	refused (unsupported_obligation): this surface cannot mask content	allow
Orchestrator response phase	withhold	mask	nothing

A redaction is mandatory, so a plane that cannot carry it out refuses the request rather than passing the content unmasked. The shipped policies bind each plane an action it can discharge; a redaction an organization's override makes mandatory is never downgraded.

In v10.x the proxy's POST /api/v1/request tier-aware pass read the row's stored action with no organization override applied, and Claude Code / Cowork OTEL ingest redacted at the collector whatever the action. In v11 both planes are decided by the policy decision engine like every other, with the actions the posture table lists for them.

When an override weakens a stored action

From platform v9.19.0 to v10.x, a downward displacement (a stored block resolved to redact under a pii=redact override, say) put an advisory reason on the decision API's allow verdict. In v11 that reason is no longer emitted: the decision names the policy that decided, and a matched policy that attaches no obligation the wire carries is named in the allow verdict's reasons. axonflow_agent_policy_stored_action_displaced_total{category,stored,resolved} still counts displacements on the planes that resolve an action through the shared conversion, so an alert built on it keeps working.

Upward displacement (an override tightening a warn row to block) is the override doing its designed job and is not counted.

Worked example: sys_pii_indonesia_ktp

The shipped policy's action is block on every plane that runs it.

• No override: POST /api/v1/decide with a query that matches the policy's KTP pattern returns verdict=deny.
• pii=redact override: the same request returns verdict=allow with a redact_pii obligation, and the policy in evaluated_policies.
• pii=block override: the request returns verdict=deny.

If your compliance posture requires KTP or NIK to hard-deny, do not record a pii override weaker than block.

Authoring guidance

Before relying on a policy's action, check three things: its shipped action on the plane in question (in Shipped Policy Posture), whether your organization has changed that policy, and whether it has recorded an override for the policy's detection category (GET /api/v1/detection-posture). Changing a policy and recording an override are both audited, and an override reaches every policy in its category.

Pattern-Based System Policies

Security - SQL Injection (security-sqli)

38 patterns covering all major SQL injection techniques.

UNION-Based Injection (2 patterns)

ID	Name	Severity	Action
sys_sqli_union_select	UNION SELECT Detection	Critical	Warn
sys_sqli_union_injection	UNION Injection After Termination	Critical	Warn

Boolean-Based Blind Injection (3 patterns)

ID	Name	Severity	Action
sys_sqli_or_true	OR True Condition	High	Warn
sys_sqli_or_string	OR String Condition	High	Warn
sys_sqli_and_false	AND False Condition	High	Warn

Time-Based Blind Injection (4 patterns)

ID	Name	Severity	Action
sys_sqli_sleep	MySQL SLEEP Function	Critical	Warn
sys_sqli_waitfor	SQL Server WAITFOR DELAY	Critical	Warn
sys_sqli_pg_sleep	PostgreSQL pg_sleep	Critical	Warn
sys_sqli_benchmark	MySQL BENCHMARK Function	Critical	Warn

Error-Based Injection (3 patterns)

ID	Name	Severity	Action
sys_sqli_extractvalue	EXTRACTVALUE Function	High	Warn
sys_sqli_updatexml	UPDATEXML Function	High	Warn
sys_sqli_convert_int	CONVERT INT Injection	High	Warn

Stacked Queries (5 patterns)

ID	Name	Severity	Action
sys_sqli_stacked_drop	Stacked DROP Statement	Critical	Warn
sys_sqli_stacked_delete	Stacked DELETE Statement	Critical	Warn
sys_sqli_stacked_update	Stacked UPDATE Statement	Critical	Warn
sys_sqli_stacked_insert	Stacked INSERT Statement	Critical	Warn
sys_sqli_stacked_exec	Stacked EXEC Statement	Critical	Warn

Comment-Based Injection (4 patterns)

ID	Name	Severity	Action
sys_sqli_inline_comment	Inline Comment Injection	High	Warn
sys_sqli_line_comment_mysql	MySQL Line Comment Injection	High	Warn
sys_sqli_line_comment_dash	Double-Dash Comment Injection	High	Warn
sys_sqli_string_term_comment	String-Terminator Comment Injection	High	Warn

Generic Patterns (9 patterns)

ID	Name	Severity	Action
sys_sqli_select_from	SELECT FROM After Termination	Critical	Warn
sys_sqli_admin_bypass	Authentication Bypass	Critical	Warn
sys_sqli_hex_encoding	Hex-Encoded Payload	Medium	Warn
sys_sqli_char_function	CHAR Function Obfuscation	High	Warn
sys_sqli_concat_select	CONCAT with Embedded SELECT	High	Warn
sys_sqli_information_schema	INFORMATION_SCHEMA Access	High	Warn
sys_sqli_sys_tables	System Tables Access	High	Warn
sys_sqli_load_file	LOAD_FILE Function	Critical	Warn
sys_sqli_into_outfile	INTO OUTFILE/DUMPFILE	Critical	Warn

Dangerous Query Patterns (8 patterns)

ID	Name	Severity	Action
sys_sqli_drop_table	DROP TABLE Statement	Critical	Warn
sys_sqli_drop_database	DROP DATABASE Statement	Critical	Warn
sys_sqli_truncate	TRUNCATE TABLE Statement	Critical	Warn
sys_sqli_alter_table	ALTER TABLE Statement	High	Warn
sys_sqli_delete_no_where	DELETE Without WHERE	Critical	Warn
sys_sqli_create_user	CREATE USER Statement	Critical	Warn
sys_sqli_grant	GRANT Privileges Statement	Critical	Warn
sys_sqli_revoke	REVOKE Privileges Statement	Critical	Warn

---

Security - Admin Access (security-admin)

4 patterns guarding access to sensitive administrative tables and schemas.

ID	Name	Severity	Action	Description
sys_admin_users_table	Users Table Access	High	Block	Access to users table
sys_admin_audit_log	Audit Log Access	High	Block	Access to audit logs
sys_admin_config_table	Configuration Table Access	High	Block	System config access
sys_admin_info_schema	Information Schema Access	Medium	Block	System schema access

---

Security - Dangerous Instructions (security-dangerous)

4 patterns detecting indirect prompt-injection attempts in free-text that flows into the model (OWASP LLM01). These guard merchant/user-controlled fields and ship as block.

ID	Name	Severity	Action	Description
sys_dangerous_injection_override	Prompt Injection - Instruction Override	High	Block	"Ignore/disregard previous instructions" and similar overrides
sys_dangerous_injection_role_override	Prompt Injection - Role Reassignment	High	Block	Attempts to reassign the assistant to a privileged/jailbreak persona
sys_dangerous_injection_system_exfil	Prompt Injection - System Prompt Exfiltration	High	Block	Attempts to reveal/print/repeat the system prompt or hidden instructions
sys_dangerous_injection_bracket_marker	Prompt Injection - Template/Bracket Marker	High	Block	Injected chat-template/role-delimiter markers ([system], <im_start>, ### system)

---

Sensitive Data / Secrets (sensitive-data)

6 patterns detecting credentials and secrets in request/response content (generic, provider-agnostic).

ID	Name	Severity	Action	Description
sys_sensitive_api_key	API Key Detection	High	Warn	Generic API-key assignment patterns
sys_sensitive_token	Token Detection	High	Warn	Bearer/access tokens in content
sys_sensitive_secret	Secret Detection	High	Warn	Generic secret assignment patterns
sys_sensitive_password	Password Detection	High	Warn	Password values in content
sys_sensitive_credentials	Credentials Detection	High	Warn	Combined credential patterns
sys_sensitive_connection	Connection String Detection	High	Warn	Database/service connection strings

---

PII - Global (pii-global)

7 universal patterns applicable in all regions.

ID	Name	Severity	Action	Description
sys_pii_credit_card	Credit Card Number	Critical	Warn	Visa, MC, Amex, Discover, Diners, JCB
sys_pii_passport	Passport Number	High	Warn	Generic passport format
sys_pii_dob	Date of Birth	High	Log	Common date formats
sys_pii_email	Email Address	Medium	Log	Standard email format
sys_pii_phone	Phone Number	Medium	Log	International formats
sys_pii_ip_address	IP Address	Medium	Log	IPv4 addresses
sys_pii_booking_ref	Booking Reference	Low	Log	Context-anchored 6-char alphanumeric

---

PII - United States (pii-us)

ID	Name	Severity	Action	Description
sys_pii_ssn	Social Security Number	Critical	Warn	XXX-XX-XXXX format
sys_pii_bank_account	Bank Account Number	Critical	Warn	Routing + account number

---

PII - European Union (pii-eu)

ID	Name	Severity	Action	Description
sys_pii_iban	IBAN	Critical	Warn	International Bank Account Number

---

PII - India (pii-india)

ID	Name	Severity	Action	Description
sys_pii_pan	PAN (Permanent Account Number)	Critical	Warn	10-char with entity-type validation
sys_pii_aadhaar	Aadhaar Number	Critical	Warn	12-digit UID (DPDP Act 2023)

---

PII - Singapore (pii-singapore)

Singapore-specific patterns support MAS FEAT-oriented governance and regional privacy controls in Community Edition. These ship as redact.

ID	Name	Severity	Action	Description
sys_pii_singapore_nric	Singapore NRIC Detection	Critical	Redact	National Registration Identity Card pattern
sys_pii_singapore_fin	Singapore FIN Detection	Critical	Redact	Foreign Identification Number pattern
sys_pii_singapore_uen	Singapore UEN Detection	High	Redact	Unique Entity Number pattern
sys_pii_singapore_phone	Singapore Phone Detection	Medium	Redact	+65 phone numbers
sys_pii_singapore_postal	Singapore Postal Code Detection	Low	Warn	Six-digit postal code pattern

---

PII - Indonesia (pii-indonesia)

Indonesia KTP/NIK detection for OJK / BI / UU PDP compliance. The Community shared engine seeds the KTP menu entry as block; the Enterprise Indonesia PII detector additionally enforces NIK, NPWP, phone, and major-bank account patterns at runtime with NIK validation.

ID	Name	Severity	Action	Description
sys_pii_indonesia_ktp	Indonesian KTP Detection	Critical	Block	16-digit KTP/NIK (keyword-anchored, NIK-validated)

---

Condition-Based System Policies

Condition-based policies use context-aware rules evaluated by the Orchestrator. These provide runtime governance for risk, compliance, cost, and access control.

Policy ID Naming Convention

System policy IDs follow the pattern: sys_ + category abbreviation + specific pattern name.

Prefix	Meaning	Example
sys_sqli_	SQL injection pattern	sys_sqli_union_select
sys_admin_	Admin access control	sys_admin_users_table
sys_dangerous_	Prompt-injection guard	sys_dangerous_injection_override
sys_sensitive_	Secret / sensitive-data pattern	sys_sensitive_api_key
sys_pii_	PII detection pattern	sys_pii_ssn
sys_dyn_	Dynamic/condition-based policy	sys_dyn_high_risk_block
sys_media_	Media-governance policy (image, document, biometric)	sys_media_nsfw_block

Risk Management (dynamic-risk)

ID	Name	Condition	Action
sys_dyn_high_risk_block	Block High-Risk Queries	risk_score > 0.8	Warn
sys_dyn_anomalous_access	Anomalous Access Detection	risk_score > 0.6 and anomalous access pattern	Alert

sys_dyn_high_risk_block keeps the name it shipped with, but its shipped action is warn.

Condition example (as returned by GET /api/v1/policies):

{
  "id": "sys_dyn_high_risk_block",
  "name": "Block High-Risk Queries",
  "type": "risk_based",
  "category": "dynamic-risk",
  "tier": "system",
  "conditions": [
    {"field": "risk_score", "operator": "greater_than", "value": 0.8}
  ],
  "actions": [
    {"type": "block", "config": {"reason": "Query risk score exceeds safety threshold"}}
  ],
  "enabled": true
}

Compliance (dynamic-compliance)

ID	Name	Condition	Action
sys_dyn_hipaa	HIPAA Compliance	Healthcare data keywords present	Redact + Log
sys_dyn_gdpr	GDPR Compliance	User region in EU/EEA/UK	Redact + Log
sys_dyn_financial	Financial Data Protection	Financial data keywords present	Redact + Log

Condition example (as returned by GET /api/v1/policies):

{
  "id": "sys_dyn_hipaa",
  "name": "HIPAA Compliance",
  "type": "compliance",
  "category": "dynamic-compliance",
  "tier": "system",
  "conditions": [
    {"field": "query", "operator": "contains_any", "value": ["patient", "diagnosis", "treatment", "medical_record", "prescription"]}
  ],
  "actions": [
    {"type": "redact", "config": {"fields": ["patient_id", "ssn", "medical_record_number"]}},
    {"type": "log", "config": {"compliance": "hipaa"}}
  ],
  "enabled": true
}

Security Controls (dynamic-security)

ID	Name	Condition	Action
sys_dyn_tenant_isolation	Tenant Isolation	Cross-tenant tenant_id access attempt	Block
sys_dyn_debug_restrict	Debug Mode Restriction	debug query outside development environment	Block

Cost Management (dynamic-cost)

ID	Name	Condition	Action
sys_dyn_expensive_query	Expensive Query Limit	cost_estimate > 100	Alert + Log
sys_dyn_llm_cost	LLM Cost Optimization	LLM chat and monthly_llm_usage > 1000	Add risk + Alert

Access Control (dynamic-access)

ID	Name	Condition	Action
sys_dyn_sensitive_data	Sensitive Data Control	Query references salary, SSN, or medical records	Redact

Media Safety (media-safety)

Media-governance controls evaluate the classifier scores and flags attached to an image or document by the media pipeline, so they only fire on requests that carry media.

ID	Name	Condition	Action
sys_media_nsfw_block	NSFW Content Blocking	media.nsfw_score > 0.8	Block
sys_media_violence_warn	Violence Content Warning	media.violence_score > 0.7	Alert + Log

Media Biometric (media-biometric)

ID	Name	Condition	Action
sys_media_biometric_log	Biometric Data Audit	media.has_biometric_data is true	Log

Media PII (media-pii)

ID	Name	Condition	Action
sys_media_pii_block	Image PII Blocking	media.has_pii is true	Block

Media Document (media-document)

ID	Name	Condition	Action
sys_media_sensitive_doc_warn	Sensitive Document Detection	media.is_sensitive_document is true	Alert + Log

---

Querying System Policies

List All System Policies

const policies = await client.listStaticPolicies({
  tier: 'system'
});

console.log(`Total system policies: ${policies.length}`);

Filter by Category

// Get all SQL injection policies
const sqli = await client.listStaticPolicies({
  tier: 'system',
  category: 'security-sqli'
});

// Get all PII policies
const pii = await client.listStaticPolicies({
  tier: 'system',
  category: 'pii-global'
});

REST API

# All system policies
curl "http://localhost:8080/api/v1/system-policies?tier=system"

# Filtered by category
curl "http://localhost:8080/api/v1/system-policies?tier=system&category=security-sqli"

---

Customizing System Policies

You cannot modify a system policy's pattern or condition. In v11 your organization can, on every edition, disable a shipped policy, re-enable it, or change its action to block, redact, warn or log, for that organization only.

To change every policy in a detection category at once, record a detection-posture override for the category, for example pii=block. It re-actions the platform's policies in that category on the planes that apply organization overrides (the Decision API, Gateway Mode's pre-check, MCP, the OpenAI-compatible route, Proxy Mode's request, the orchestrator's response filter and the policy test surface), and not the 22 organization-editable policies, which your organization changes in its own typed policy document.

v10.x per-policy overrides

In v10.x a per-policy override was recorded through POST /api/v1/system-policies/{id}/override (the SDKs' createPolicyOverride), optionally with an expiration, and required an Enterprise license. Those routes are deprecated with the rest of the legacy system-policy family: the v11 policy decision engine does not read what they write, so an override recorded there changes no v11 decision. Overrides already recorded that way are carried into v11's per-policy control once, at upgrade.

---

Related

• Policy Hierarchy - Understanding tier inheritance
• SDK Methods - Full API reference
• Policy Testing - Test patterns before deployment

Rollout Checklist

Use this page as one layer of the broader governance rollout:

• decide where the rule belongs with Policy Hierarchy
• test the request path with Runtime Request Paths
• connect review workflows to HITL Approval Gates when a block should become a human decision
• compare Community vs Evaluation vs Enterprise when simulation, evidence export, SSO, SCIM, or portal operations become requirements