Skip to main content

Author policies in plain English

You can describe a policy in a sentence and get a draft back. A draft is never saved until you create or publish it, so nothing happens to your agents while you experiment.

Needs the policy-author model

Plain-English authoring uses a language model that your Bairav administrator must enable. If it is off, POST /api/policies/author answers with "ok": false and a reason instead of a draft. Everything else on this page works without it.

The flow​

  1. Author. POST /api/policies/author with your sentence returns a draft policy (never persisted). POST /api/policies/compile turns natural language into a structured draft.
  2. Preview. POST /api/policies/preview shows how many agents the draft would match, with up to six names. Matching zero agents does not stop you saving.
  3. Check conflicts. POST /api/policies/conflicts runs a deterministic analysis against your existing policies.
  4. Create, then publish. POST /api/policies saves it. Policies can be kept as drafts (PUT /api/policies/{id}/draft) and published with POST /api/policies/{id}/publish. Every version is kept (GET /api/policies/{id}/versions).

These calls need the admin or reviewer role, except preview and conflicts, which any signed-in user can run.

Create a policy directly​

curl -X POST "https://$BAIRAV_HOST/api/policies" \
  -H "Authorization: Bearer $BAIRAV_ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Block prompt injection phrases",
    "description": "Refuse requests that try to override instructions.",
    "action": "block",
    "definition": {
      "guardrail": {
        "deny_prompt_patterns": ["(?i)ignore (all )?previous instructions"],
        "message": "This request was blocked by policy."
      }
    }
  }'

action is block, require_approval, flag or notify, and defaults to block: a policy created without an explicit action stops what it matches rather than merely mentioning it.

Then prove it before it matters​

Run the change through Try it out to see the decision for a sample request, and replay past gateway decisions against today's policies with POST /api/policies/replay.