Skip to content
TapPass

Policy templates

Two fast paths get you from intent to a validated policy without hand-writing rules:

  • Templates — curated multi-rule starter sets (an OWASP agentic baseline, coding-agent safety, compliance frameworks, and more), surfaced in Policies → Templates in the dashboard and browsable from the CLI. These were previously called packs; see the catalog reference.
  • The rule catalog — parameterized single-rule generators: supply params, get back one validated, ready-to-run rule for a recognizable pattern.

Templates: curated starter sets

Section titled “Templates: curated starter sets”
Terminal window
tappass template list
tappass template get owasp-agentic-baseline

Apply a template from the dashboard (Policies → Templates), or use it as the starting point for policy create and adjust from there.

The rule catalog: parameterized generators

Section titled “The rule catalog: parameterized generators”
Generator What it does Params
block_tool_when_pii_detected Block a specific tool call when PII is present in the request target_tool (required), pii_count_threshold (default 1)
block_after_n_sor_writes Block system-of-record writes after N writes in the session max_writes_per_session (default 3), target_prefix (default all)
rate_limit_tool_per_session Cap calls to one tool per session target_tool (required), max_calls_per_session (default 10)

block_after_n_sor_writes and rate_limit_tool_per_session read the full path projection and require the paths_in_policy feature flag — see sessions.

Terminal window
# List and inspect
tappass policy rules list
tappass policy rules get block_tool_when_pii_detected


# Render the policy from generator + params
tappass policy rules instantiate block_tool_when_pii_detected \
  --param target_tool=send_email --param pii_count_threshold=1

Instantiation validates params strictly (unknown params are rejected, types are coerced) and validates the rendered policy — what comes out is guaranteed to compile. The rendered policy then goes through the normal lifecycle: draft → shadow → active.

Templates vs. rule kinds

Section titled “Templates vs. rule kinds”
  • Rule kinds (BlockPII, AllowedModels, …) are single, composable statements — the atoms you build policies from.
  • Rule-catalog generators are pre-assembled molecules for one recognizable pattern, with their own params and rendered body.
  • Templates are curated sets of rules for a whole posture — the largest grain.

Most policies are built from rule kinds; reach for a generator when its pattern is exactly your intent, and a template when you want a reviewed baseline to start from.

Next steps

Section titled “Next steps”