---
title: "Policies · Ataris"
description: "Write rules for file reads and writes, process execs, network egress, shell commands, MCP tools, and skills. On Pro and above, the ataris CLI checks every tool call against them before it runs, refuses the ones a rule blocks, and records each decision next to the action it governed."
canonical: "https://ataris.dev/product/policies"
last-updated: 2026-10-10
---
# Decide what your agents are allowed to reach.

Write rules for file reads and writes, process execs, network egress, shell commands, MCP tools, and skills. On Pro and above, the ataris CLI checks every tool call against them before it runs, refuses the ones a rule blocks, and records each decision next to the action it governed.

## How a policy is applied

1. **Write the rules.** Each rule has an action, a glob pattern, and an effect: allow, alert, or block. Create policies in the dashboard under Policies.
2. **Target it by tag.** A policy applies to every session that carries all of its tags, such as team:infra, or to every session if it has none. When several match, the strictest decision wins.
3. **Check every action.** Before each tool call runs, the CLI matches what it would do against the rules in order. The first matching rule wins, and an action no rule matches is allowed. Activity underneath, such as what a script does, is checked the same way as it arrives.
4. **Record the decision.** Each verdict lands on the policy lane of the timeline, next to the action it governed.

## What a policy does today

- **Blocks tool calls.** A block rule refuses a matching tool call before it runs, such as npm publish, a read of ~/.ssh, a fetch to an unknown host, or an MCP tool, and the attempt is recorded as blocked.
- **Alerts on what runs underneath.** Processes, files, and connections underneath a tool call are checked against the same rules and raise alerts, with the intended effect in the event. They aren't stopped.
- **Matches with globs.** Match paths against the agent's home or working directory, binaries by name or full path, commands such as npm publish*, MCP calls as server/tool, and hosts with wildcards such as *.example.com.
- **Starts from a sensible default.** New workspaces start with a policy that alerts on reads of common credential locations such as ~/.aws, ~/.ssh, ~/.kube, and .env files, and allows everything else.

## A policy is a list of rules

Here a read of ~/.aws/config is allowed because its rule comes first, a read of ~/.aws/credentials raises an alert, and npm publish and fetches to *.unknown are refused before they run.

```json
[
  { "action": "read",    "pattern": "~/.aws/config", "effect": "allow" },
  { "action": "read",    "pattern": "~/.aws/**",     "effect": "alert" },
  { "action": "command", "pattern": "npm publish*",  "effect": "block" },
  { "action": "egress",  "pattern": "*.unknown",     "effect": "block" }
]
```

## Common questions

### What happens when no rule matches?

The action is allowed. Rules are checked in order and the first match wins, so put specific rules above broad ones.

### Can a policy stop something a script does?

Not yet. The CLI blocks at the tool call: a rule refuses the command, file access, fetch, MCP tool, or skill the agent asks for. What a script then does underneath is recorded and raises alerts, but isn't stopped.

### Which plans include policies?

Pro and Enterprise. On Starter, sessions run observe-only: everything is recorded and flagged, and no rule blocks or alerts.

### How do I use a policy?

Create it in the dashboard under Policies and give it the tags of the sessions it should govern. The CLI picks it up when the next session starts.

## Put limits on what your agents can reach.

Book a demo and we'll help you write a policy for the agents you run.

[Book a demo](https://ataris.dev/contact) · [Read the docs](https://ataris.dev/docs/concepts/policies.md)