Policy Overview

Policies are the rules that define what content should be blocked, detected, or redacted when users interact with AI platforms. This guide explains how policies work and how to manage them.

What is a Policy?

A policy is a rule that:

• Detects specific patterns in content
• Takes action when patterns are found
• Records the event for audit

Policies run in real-time as users interact with AI platforms, enforcing your organization's data protection requirements.

Policy Components

Each policy consists of:

Detection Rules

What the policy looks for:

• Keyword detection - Specific words or phrases
• Pattern matching - Regular expressions
• Field rules - Field / operator / value conditions combined with AND/OR (fields include prompt, response, destination domain, actor, and model)

Enforcement Action

What happens when detected — one of three stored actions:

• block - Prevent the submission
• detect - Record the event and create an alert without blocking
• redact - Mask the matched content before the prompt is sent

The policy editor labels these differently on different screens; see Configuring Policies for the label map.

Scope

Where the policy applies:

• Organization - Every team in your organization
• Team - Only the teams you select (plan-gated)

note

Policies are not scoped per AI platform or per individual user. A policy applies across the monitored surfaces; per-user exemptions are handled through Exceptions, and per-site control types are configured under Site Controls.

Built-In Policy Templates

Containment.AI ships a gallery of policy templates you can apply as-is or adapt. They are grouped as:

• National security & defense — DoD acceptable-use enforcement, export-controlled technical data (EAR and arms-control regimes), classified-egress, and CUI handling
• General guardrails — the remaining templates, covering PII, credentials and secrets, and compliance-framework-aligned rules

Representative templates include:

Template	Detects
Block PII sharing	Common PII patterns including SSNs, credit-card numbers, phone numbers, and email addresses
Block API keys & credentials	API keys, passwords, and connection strings
HIPAA — Block PHI	Protected health information
GDPR — EU PII protection	EU personal-data patterns
SOC 2 — Block financial data	Financial and revenue data

note

Browse the live gallery from Policies > Use template for the current list — it is the authoritative set. Applying a template creates a policy you own, which you can then edit. A template's default enforcement action depends on how it is applied: the onboarding starter policy is created enabled and blocking, while templates cloned from the gallery start as detect-style and disabled so you can review them before enforcing.

Policy States

Enabled

• Policy is active and enforcing
• Violations generate alerts
• Users see blocks or detections

Disabled

• Policy is not running
• No enforcement occurs
• Existing alerts remain

note

There is no test/shadow state that runs a policy without enforcing it — use a detect-style enforcement action to observe without blocking. In-progress custom policies can be saved as drafts, but drafts are not yet listed anywhere in the UI.

Policy Scope

A policy is scoped either organization-wide or to selected teams:

Organization Policies
    ↓
Team Policies

Team scoping is plan-gated. Per-site control types are configured separately under Site Controls.

Plan Availability

Feature	Free	Professional	Enterprise
Prebuilt guardrail library	✓ (read-only)	✓	✓
Enable/disable	✓	✓	✓
Custom policy filters	✗	✓	✓
Exception workflows	✗	✓	✓
Scope by team & environment	✗	Basic	Full

Getting Started

1. Review the available Policy Categories
2. Configure policies for your needs
3. Set up exceptions for legitimate use cases

Best Practices

Start Conservative

• Begin with a detect-style enforcement action
• Review alerts before switching to block
• Gradually tighten controls

Tune Regularly

• Check for false positives weekly
• Refine keywords and patterns as needed
• Grant narrow, time-limited exceptions for legitimate matches

Document Decisions

• Keep notes on why policies are configured
• Track exceptions and their justifications
• Maintain audit trail of changes

Related Topics

• Policy Categories - Explore available policies
• Configuring Policies - Set up and customize
• Exceptions - Handle edge cases