Policy Engine (Cage Rules)

The Policy Engine lets you define rules that govern what agents can and cannot do inside sandboxes. Policies are enforced at the MCP tool layer, LLM proxy, file system, network, and command execution levels.

How It Works

You define policies with rules — each rule targets a scope (tool, file, command, network, llm) and specifies an action (allow, deny, audit, pause)
When an agent attempts an operation, the engine evaluates all active policies
The first deny or pause rule that matches blocks the operation immediately
audit rules log a cage_break event but don’t block

Policy Inheritance

Policies support a three-level hierarchy:

org → team → project

Org-level policies apply to all sandboxes in the account
Team-level policies apply to a specific team
Project-level policies apply to a specific project

Child policies inherit parent rules. A child can override a parent rule by declaring the same rule ID with a different action.

Built-in Templates

Apply production-ready templates with a single command:

Template	Description
`soc2`	PII redaction, injection blocking, secret file protection, destructive command blocking
`hipaa`	Strict PHI blocking, restricted tools, git-push requires approval
`dev-only`	Permissive — audit everything, block only fork bombs & rm -rf /
`restrictive`	Read-only filesystem, no network, full PII blocking
`permissive`	Uncaged mode — audit only, nothing blocked

YAML Configuration

Add policies to your .caged.yaml:

policy:
  template: soc2
  denied_tools:
    - "dangerous_tool"
  denied_commands:
    - "rm -rf"
    - "curl"
  denied_files:
    - ".env"
    - "*.pem"
  scan_pii: true
  scan_injection: true
  require_approval:
    - "write_file"
    - "execute_command"

API

# List policies
curl -H "Authorization: Bearer $TOKEN" https://api.caged.dev/v1/policies

# Apply template
curl -X POST -H "Authorization: Bearer $TOKEN" \
  https://api.caged.dev/v1/policies/templates/soc2/apply

# Create custom policy
curl -X POST -H "Authorization: Bearer $TOKEN" \
  -d '{"name":"no-secrets","level":"org","rules":[...]}' \
  https://api.caged.dev/v1/policies

CLI

# List policies
caged policy list

# View available templates
caged policy templates

# Apply a template
caged policy apply soc2

# Delete a policy
caged policy delete <id>

Content Scanning

The engine includes built-in content scanners for LLM traffic:

PII Detection

Detects: email addresses, SSNs, credit card numbers, phone numbers, IP addresses, API keys, AWS secrets, private keys.

Prompt Injection Detection

12 heuristic signals with weighted scoring. Blocks content scoring above 0.7 threshold.

Dashboard

Manage policies from the web dashboard at /dashboard/policies:

View all active policies with level, priority, and rule counts
Apply templates with one click
Enable/disable policies

Getting Started

Guides

Policy Engine

Policy Engine (Cage Rules)

How It Works

Policy Inheritance

Built-in Templates

YAML Configuration

API

CLI

Content Scanning

PII Detection

Prompt Injection Detection

Dashboard

​Policy Engine (Cage Rules)

​How It Works

​Policy Inheritance

​Built-in Templates

​YAML Configuration

​API

​CLI

​Content Scanning

​PII Detection

​Prompt Injection Detection

​Dashboard

Policy Engine (Cage Rules)

How It Works

Policy Inheritance

Built-in Templates

YAML Configuration

API

CLI

Content Scanning

PII Detection

Prompt Injection Detection

Dashboard