Single-Policy Documents

A single-policy document configures one control on its own, without pack or policies.chain. The schema accepts it for four controls: prompt-injection, agent-firewall, citation-verifier, and quality-scorer.

Use it to check the structure of one control's settings. A gateway cannot run it. For a gateway or a policy test, use a full config, and move the sections into policy.<kind> before deployment.

Syntax

The document starts with a policy object. policy.name selects the control, and with it the top-level sections that are allowed:

prompt-injection.yaml

policy:
  name: prompt-injection
  version: 1.0.0
  enabled: true

detection:
  embedding_threshold: 0.8

response:
  action: block

Control	Allowed top-level sections
prompt-injection	detection, encoding, boundaries, response
agent-firewall	tools, rate_limits, transaction_limits, kill_switches, monitoring, max_actions_per_session
citation-verifier	verification, rag_context, output_action, response
quality-scorer	providers, targets, benchmarks, assertions, thresholds, weights, industry_profiles, failure_action

Fields

Field	Type	Description
policy.name	One of the four controls	Selects the control. Required.
policy.version	SemVer string	Version of the document. Required.
policy.enabled	boolean	Turns the control on or off. Required.

Lint rejects pack, policies, providers.targets, and any section that the table does not list for the control. The fields inside each section are those of the matching policy.<kind> block. See the policy field reference.

Examples

Prompt injection document

Save the file above as prompt-injection.yaml. Prompt Injection Detection describes the detection rules and a test phrase.

Agent firewall document

The standalone shape uses the expanded role-based sections. The simple allowed_tools and blocked_tools fields work only in a full config. Agent Firewall explains how declared tool checks differ from an execution boundary.

Citation verifier document

Use the verification, rag_context, output_action, and response sections from Citation Verifier. A citation check needs source context, and a URL does not prove that the facts are correct.

Quality scorer document

Quality Scorer describes the assertions and their evaluators. Convert to a full config before you add tests. Start with a deterministic assertion, such as a required phrase.

Lint a single-policy document

verdictan policy lint --file prompt-injection.yaml

A valid file exits with code 0.

Move to a full config document

Add a pack, a policies.chain entry, and move the sections into policy.<kind>:

policy-config.yaml

pack:
  name: example-gateway
  version: 1.0.0
  enabled: true

policies:
  chain:
    - prompt-injection

policy:
  prompt-injection:
    embedding_threshold: 0.8
    response:
      action: block

The fields of detection move to the top of policy.prompt-injection. encoding, boundaries, and response keep their names. The same applies to the verification section of citation-verifier: its fields move to the top of the block.

Limits and failure behavior

Capability	Full config	Single-policy document
pack metadata	Yes	No
policies.chain	Yes	No
More than one control	Yes	No
Provider targets	Yes	No
Runs on a gateway	Yes	No

• Lint rejects a single-policy document with any other policy.name.
• A gateway that loads a single-policy document registers no chain, because the document has none.

Next steps

• Declarative Config Reference: the fields of each section.
• Test Configuration: add tests after you move to a full config.