Every rule is an instantiation of a rule kind with parameters. Kinds are grouped into families by what they govern. Phase is when the rule runs: pre (before the action) or post (on the response). Every rule can run in enforce or shadow mode.
Terminology: the CLI and API call rule kinds controls — tappass policy controls lists the same vocabulary this page documents. BlockPromptInjection the kind = BlockPromptInjection the control.
Parameter values are the keys the compiled rule reads; all are set in the rule payload when authoring.
| Kind |
What it does |
Key params |
Phase |
BlockPII |
PII detected in the request |
on_pii (block or redact obligation) |
pre |
BlockSecrets |
Secret/credential patterns in the request |
— |
pre |
BlockPromptInjection |
Injection score above threshold |
threshold (0–1) |
pre |
BlockUnicodeTricks |
Zero-width, bidi, confusable codepoints |
— |
pre |
BlockResponsePII |
PII in the model’s response |
— |
post |
BlockResponseSecrets |
Secrets in the response |
— |
post |
BlockResponseInjection |
Indirect injection in the response |
threshold |
post |
BlockExfilDomains |
Request targets one of the listed (blocklisted) domains |
domains (list) |
pre |
BlockForbiddenPaths |
Filesystem path matches a forbidden pattern |
patterns (list) |
pre |
BlockToolIntegrityDrift |
Tool definition changed since approval |
— |
pre |
| Kind |
What it does |
Key params |
Phase |
AllowRequest |
Explicitly allow matching requests (short-circuit) |
— |
pre |
RequireApproval |
Suspend the call for human approval |
tier (e.g. authenticated) |
pre |
| Kind |
What it does |
Key params |
Phase |
AllowedModels |
Only these models may be called |
models (list) |
pre |
AllowedProviders |
Only these providers |
providers (list) |
pre |
AllowedRegions |
Only these model regions |
regions (list) |
pre |
AllowedModelTier |
Only these catalog tiers |
tiers (list) |
pre |
BlockModel |
These models may not be called |
models (list) |
pre |
RouteToModel |
Rewrite the requested model (obligation) |
model |
pre |
CapReasoning |
Cap reasoning effort |
allowed_effort |
pre |
RequireLocalModel |
Require an on-prem/local model |
— |
pre |
| Kind |
What it does |
Key params |
Phase |
AllowTool |
Explicitly allow a tool |
tools |
pre |
BlockTool |
Block specific tools |
tools (list) |
pre |
ConstrainToolArgs |
Arg values must satisfy constraints |
constraints — operators match, in, prefix, suffix, range, within_days |
pre |
BlockToolArgMatch |
Block when an arg matches a pattern |
matchers |
pre |
RedactToolArg |
Regex-redact a pattern inside a named arg (obligation) |
tool, arg, pattern |
pre |
RestrictToolToSubject |
Tool usable only by listed subjects |
subjects |
pre |
DenyCapability |
Block calls requiring a denied capability |
capabilities |
pre |
AllowCapabilities |
Containment envelope: allow only these capabilities, deny the rest |
capabilities, on_violation (block or escalate) |
pre |
ConstrainCapabilityArgs |
Constrain how a capability is used across every tool providing it |
capability, constraints (operators below) |
pre |
ToolArgOutlier |
Block args anomalous vs this agent’s learned baseline |
— |
pre |
AllowCapabilities is the strongest primitive here: envelopes compose by intersection across scopes, so a broader scope can never widen what a narrower scope forbade.
ConstrainToolArgs and ConstrainCapabilityArgs share one operator set — the bound arg must satisfy the constraint or the call is blocked:
| Operator |
Arg type |
Passes when |
match |
string / string list |
value matches the regex (every element, for a list) |
in |
any |
value is one of value (every element, for a list) |
prefix / suffix |
string / string list |
value starts / ends with value |
range |
number |
value[0] ≤ v ≤ value[1] |
within_days |
RFC3339 date |
the date is at most value days beyond now — blocks far-future edits. Uses the recorded decision clock, so evaluation is deterministic and replayable. |
max_deviation_pct |
number |
value deviates at most value percent from a baseline carried in the same call under reference_slot. Fail-closed — a missing or zero baseline blocks. ConstrainCapabilityArgs only. |
| Kind |
What it does |
Key params |
Phase |
MaxTokensPerRequest |
Cap tokens in a single call |
max |
pre |
MaxTokensPerDay |
Cap cumulative daily tokens |
max |
pre |
SessionRateLimit |
Cap events per session |
max |
pre |
MaxSpend |
Cap windowed spend |
window (session/day/month), unit (usd/tokens), limit |
pre |
Numeric caps merge as the minimum across all assigned policy layers — the strictest applicable limit wins.
| Kind |
What it does |
Key params |
Phase |
BlockToolSequence |
Block a tool once a forbidden predecessor sequence appears in the session trajectory |
tools (sequence over state.path.tools), mode (ordered | strict), freshness (any | immediate) |
pre |
freshness: "immediate" requires the gate to be the directly preceding event (state.path.last) — “exec allowed only straight after approval”, not “an approval happened earlier”. Taint within a session is permanent: the trajectory only grows. See sessions & path-aware policy.
| Kind |
What it does |
Key params |
Phase |
RequireGrounded |
LLM-judge groundedness score must meet threshold |
threshold (0–1) |
post |
RequireConformance |
Response must conform to a natural-language rule |
prompt, threshold |
post |
These read findings.judge.* and require the LLM judge (TAPPASS_LLM_JUDGE_ENABLED, default on).
| Kind |
What it does |
Conditional |
Boolean tree (AND / OR / NOT) over other conditions, with a declared read-set |
- Every kind declares the input paths it reads; producers run only when a rule needs them. A rule reading a path nothing supplies is a compile error.
- Regexes in params are guarded at author time — patterns that can’t compile cheaply are rejected before they reach the kernel.
- The live, org-specific catalog (including known tools and signals) is available at
GET /api/v2/policies/catalog and via tappass policy controls.
