Skip to content
TapPass

Policy templates

Two fast paths get you from intent to a validated policy without hand-writing rules:

  • Templates, curated multi-rule starter sets (an OWASP agentic baseline, coding-agent safety, compliance frameworks, and more), surfaced in Policies → Templates in the dashboard and browsable from the CLI. These were previously called packs; see the catalog reference.
  • The rule catalog, parameterized single-rule generators: supply params, get back one validated, ready-to-run rule for a recognizable pattern.

Templates: curated starter sets

Section titled “Templates: curated starter sets”
Terminal window
tappass template list
tappass template get owasp-agentic-baseline

Apply a template from the dashboard (Policies → Templates), or use it as the starting point for policy create and adjust from there.

The rule catalog: parameterized generators

Section titled “The rule catalog: parameterized generators”
Generator What it does Params
block_tool_when_pii_detected Block a specific tool call when PII is present in the request target_tool (required), pii_count_threshold (default 1)
block_after_n_sor_writes Block system-of-record writes after N writes in the session max_writes_per_session (default 3), target_prefix (default all)
rate_limit_tool_per_session Cap calls to one tool per session target_tool (required), max_calls_per_session (default 10)

block_after_n_sor_writes and rate_limit_tool_per_session read the full path projection and require the paths_in_policy feature flag, see sessions.

Terminal window
# List and inspect
tappass policy rules list
tappass policy rules get block_tool_when_pii_detected


# Render the policy from generator + params
tappass policy rules instantiate block_tool_when_pii_detected \
  --param target_tool=send_email --param pii_count_threshold=1

Instantiation validates params strictly (unknown params are rejected, types are coerced) and validates the rendered policy, what comes out is guaranteed to compile. The rendered policy then goes through the normal lifecycle: draft → shadow → active.

Templates vs. rule kinds

Section titled “Templates vs. rule kinds”
  • Rule kinds (BlockPII, AllowedModels, …) are single, composable statements, the atoms you build policies from.
  • Rule-catalog generators are pre-assembled molecules for one recognizable pattern, with their own params and rendered body.
  • Templates are curated sets of rules for a whole posture, the largest grain.

Most policies are built from rule kinds; reach for a generator when its pattern is exactly your intent, and a template when you want a reviewed baseline to start from.

Next steps

Section titled “Next steps”