---
title: "Policies · Ataris docs"
description: "Allow, alert, and block rules for files, processes, egress, commands, MCP tools, and skills, and how the CLI enforces them."
canonical: "https://ataris.dev/docs/concepts/policies"
last-updated: 2026-10-12
---
# Policies

Allow, alert, and block rules for files, processes, egress, commands, MCP tools, and skills, and how the CLI enforces them.

A **policy** is an ordered list of rules that Ataris checks against what the agent does. Each rule matches an action and a target, and has an effect. Policies are available on Pro and above; on Starter, sessions run observe-only.

## Rules

| Field | Values |
| --- | --- |
| `action` | `read`, `write`, `exec`, `egress`, `command`, `mcp`, or `skill` |
| `pattern` | A glob: a path, a binary name, a host or IP, a command line, an MCP call, or a skill name |
| `effect` | `allow`, `alert`, or `block` |

The **first matching rule wins**. If no rule matches, the action is allowed.

### Patterns

- **Paths** (`read`, `write`): `~/…` resolves against the agent's home, `./…` against its working directory, and `/…` is absolute. `**/.env*` matches dotfiles anywhere.
- **Binaries** (`exec`): match the binary name, such as `curl`, or its full path.
- **Hosts** (`egress`): match the host or IP, ignoring the port. `*.example.com` and `185.12.4.9` both work.
- **Commands** (`command`): match the full command line, such as `npm publish*`.
- **MCP calls** (`mcp`): match `server/tool`.
- **Skills** (`skill`): match the skill's name.

```json
[
  { "action": "read",    "pattern": "~/.aws/config", "effect": "allow" },
  { "action": "read",    "pattern": "~/.aws/**",     "effect": "alert" },
  { "action": "command", "pattern": "npm publish*",  "effect": "block" },
  { "action": "egress",  "pattern": "*.unknown",     "effect": "block" }
]
```

Here a read of `~/.aws/config` is allowed because its rule comes first, a read of `~/.aws/credentials` raises an alert, and `npm publish` and fetches to `*.unknown` are refused before they run.

## What is enforced

| Where | `alert` | `block` |
| --- | --- | --- |
| A tool call the agent asks for | Recorded as `alert` | **Enforced**: the CLI refuses the call before it runs, tells the agent why, and records the event as `blocked` |
| Activity underneath a tool call, such as what a script does | Recorded as `alert` | Recorded as `alert`, with the intended effect in the event payload. The action is not stopped. |

The CLI blocks at the tool call: a shell command, a file read or write, a web fetch, an MCP tool, or a skill. What a script then does underneath is checked against the same rules and raises alerts, but isn't stopped. Ataris re-checks every event against the policy when it arrives, so verdicts never rest on the client alone.

## The default policy

New workspaces start with a policy that alerts on reads of common credential locations and allows everything else:

- `~/.aws/**`, `~/.ssh/**`, `~/.config/gcloud/**`, `~/.kube/**`
- `~/.docker/config.json`, `~/.netrc`, `~/.git-credentials`
- `**/.env*`

## Using a policy

Create policies in the dashboard under **Policies**, and give each one the [tags](/docs/concepts/agents) of the sessions it should govern, such as `team:infra`. A policy applies to every session that carries all of its tags, or to every session if it has none. When several policies match, their rules are merged and the strictest decision wins.

A session's rules are fixed when it starts, so a policy you change applies from the next run.