Skip to main content

Write and Test Your First Policy Configuration

A policy config is the policy-config.yaml file that a gateway loads. The file contains the providers, routes, and rules of the gateway. This article shows the shape of a first file and the checks that you can do on your computer. Manage Configuration in a File gives the full procedure.

Start a configuration project​

Run verdictan init in an empty directory:

verdictan init

The command writes a starter pack with one control and one test:

policy-config.yaml
tests/
└── blocks_obvious_injection.json
policy-config.yaml
pack:
    name: my-policy
    version: 0.1.0
    enabled: true
    description: "Verdictan policy configuration"

policies:
    chain:
        - prompt-injection

policy:
    # Defaults apply; override fields here if desired.
    prompt-injection: {}

Learn the necessary sections​

Only pack and policies are necessary. Add other sections when you need them.

SectionUse
packThe name, the version, and the enabled switch of the document
policies.chainThe ordered list of controls that the gateway runs
policy.<kind>The settings for one control in the chain

In one phase, the controls run in the sequence of policies.chain. After a control returns block or escalate, the other controls of that phase do not run. Policy Configuration Overview describes the phases and the verdicts.

Keep provider keys out of the file​

Refer to a provider key by the name of its environment variable. Do not put the key value in the file:

Inside a provider target
secret_key_ref:
  env: OPENAI_API_KEY

The gateway reads OPENAI_API_KEY from the terminal or the container that runs it.

Lint and test the file​

Run these commands in the directory that contains policy-config.yaml:

verdictan policy lint --file policy-config.yaml
verdictan policy test --json

Lint examines the structure of the file and its references. policy test runs each JSON case in tests/ and each suite in the testing section of the file. Correct each failure before you continue.

For each rule that you change, add one case that the rule allows and one case that the rule blocks.

These checks do not call a model. They do not prove that provider credentials, model access, or network connections operate correctly. A live request proves those items.

Deploy the tested file​

Deploy the file to a test agent in Configurations in the Console. A deployment goes to each gateway of the selected agent.

The gateway examines its configuration approximately every 30 seconds. When it applies the configuration, it logs connected read model refresh applied updated config with the new config_version. Then send a usual request and a request that the new rule must stop.

Do not use verdictan gateway run --policy-config for this step. The current control-plane API does not serve the routes that this command calls, and the gateway does not start.

Next steps​