Policy Config
/
Config File
Policy Config as JSON
the whole organization: every policy's mode, severity and settings, and the exceptions in forcePolicy Config v13 · live
policy-config-v13.json
{
"policyConfig": {
"version": 13,
"publishedAt": "2026-10-27T16:20:00Z",
"publishedBy": "Dana (security admin)",
"note": "Transport to High ahead of the network review"
},
"policies": [
{
"id": "P-MCP",
"mode": "enforce",
"severity": "high",
"config": {
"shape": "list",
"source": "qdash P6 MCP Server Allow-List",
"matches": "mcpServer",
"title": "Sanctioned MCP servers",
"valueLabel": "Server",
"placeholder": "server name or pattern",
"scopes": [
"global",
"agent"
],
"entries": [
{
"value": "GitHub MCP",
"scope": "global",
"addedBy": "Dana (security admin)",
"lastMatched": "2026-10-08",
"note": "reviewed 2026-08"
},
{
"value": "Atlassian MCP",
"scope": "global",
"addedBy": "Dana (security admin)",
"lastMatched": "2026-10-07"
},
{
"value": "Postgres MCP (read-only)",
"scope": "agent",
"addedBy": "Sam (GRC lead)",
"lastMatched": "2026-10-02",
"note": "analytics harnesses only"
}
]
}
},
{
"id": "P-ACCT",
"mode": "observe",
"severity": "high"
},
{
"id": "P-SENS-DETECT",
"mode": "observe",
"severity": "high",
"config": {
"shape": "detectors",
"source": "qdash P9 Data Redaction (PII / PHI)",
"title": "Detected data classes",
"families": [
{
"name": "PII / PHI",
"detectors": [
{
"label": "US Social Security number",
"severity": "high",
"hits": 0,
"on": true,
"match": "SSN"
},
{
"label": "Medical record (PHI)",
"severity": "high",
"hits": 0,
"on": true,
"match": "PHI",
"note": "enable for HIPAA scope"
},
{
"label": "Email address",
"severity": "medium",
"hits": 0,
"on": false,
"match": "email"
},
{
"label": "Phone number",
"severity": "low",
"hits": 0,
"on": false,
"match": "phone"
}
]
},
{
"name": "Financial",
"detectors": [
{
"label": "Card number",
"severity": "high",
"hits": 0,
"on": true,
"match": "card number"
},
{
"label": "Bank account",
"severity": "high",
"hits": 0,
"on": true,
"match": "bank account"
}
]
}
]
}
},
{
"id": "P-SENS-SANITIZE",
"mode": "enforce",
"severity": "high",
"config": {
"shape": "detectors",
"source": "qdash P9 Data Redaction (PII / PHI)",
"title": "Redacted data classes",
"families": [
{
"name": "PII / PHI",
"detectors": [
{
"label": "US Social Security number",
"severity": "high",
"hits": 0,
"on": true,
"match": "SSN"
},
{
"label": "Medical record (PHI)",
"severity": "high",
"hits": 0,
"on": true,
"match": "PHI",
"note": "enable for HIPAA scope"
},
{
"label": "Email address",
"severity": "medium",
"hits": 0,
"on": false,
"match": "email"
},
{
"label": "Phone number",
"severity": "low",
"hits": 0,
"on": false,
"match": "phone"
}
]
},
{
"name": "Financial",
"detectors": [
{
"label": "Card number",
"severity": "high",
"hits": 0,
"on": true,
"match": "card number"
},
{
"label": "Bank account",
"severity": "high",
"hits": 0,
"on": true,
"match": "bank account"
}
]
}
]
}
},
{
"id": "P-DATA-BOUNDARY",
"mode": "off",
"severity": "critical",
"config": {
"shape": "detectors",
"source": "qdash P9 Data Redaction (PII / PHI)",
"title": "Prohibited data classes",
"families": [
{
"name": "PII / PHI",
"detectors": [
{
"label": "US Social Security number",
"severity": "high",
"hits": 0,
"on": false,
"match": "SSN"
},
{
"label": "Medical record (PHI)",
"severity": "high",
"hits": 0,
"on": true,
"match": "PHI",
"note": "enable for HIPAA scope"
},
{
"label": "Email address",
"severity": "medium",
"hits": 0,
"on": false,
"match": "email"
},
{
"label": "Phone number",
"severity": "low",
"hits": 0,
"on": false,
"match": "phone"
}
]
},
{
"name": "Financial",
"detectors": [
{
"label": "Card number",
"severity": "high",
"hits": 0,
"on": false,
"match": "card number"
},
{
"label": "Bank account",
"severity": "high",
"hits": 0,
"on": false,
"match": "bank account"
}
]
}
]
}
},
{
"id": "P-PROVIDERS",
"mode": "observe",
"severity": "medium",
"config": {
"shape": "list",
"source": "qdash P10 Egress Allow-List",
"matches": "provider",
"title": "Approved providers",
"valueLabel": "Provider",
"placeholder": "host or *.pattern.com",
"scopes": [
"global",
"agent"
],
"entries": [
{
"value": "anthropic.com",
"scope": "global",
"addedBy": "seed",
"lastMatched": "2026-10-09",
"note": "enterprise terms"
},
{
"value": "openai.com",
"scope": "global",
"addedBy": "seed",
"lastMatched": "2026-10-09",
"note": "enterprise terms"
}
]
}
},
{
"id": "P-ENTERPRISE",
"mode": "observe",
"severity": "high"
},
{
"id": "P-FILES",
"mode": "off",
"severity": "high",
"config": {
"shape": "detectors",
"source": "qdash P8 Credential Protection",
"title": "Restricted path categories",
"families": [
{
"name": "Credential files",
"detectors": [
{
"label": "SSH keys",
"severity": "high",
"hits": 0,
"on": true
},
{
"label": "Cloud credentials",
"severity": "high",
"hits": 0,
"on": true,
"note": "~/.aws, ~/.gcloud, ~/.azure"
},
{
"label": "Kubeconfigs",
"severity": "high",
"hits": 0,
"on": true
},
{
"label": "Token stores",
"severity": "medium",
"hits": 0,
"on": true
},
{
"label": "Browser profiles",
"severity": "medium",
"hits": 0,
"on": false,
"note": "noisy on dev endpoints"
}
]
}
]
}
},
{
"id": "P-TRANSPORT",
"mode": "off",
"severity": "high",
"config": {
"shape": "level",
"source": "qdash P11 TLS Floor",
"title": "Minimum TLS version",
"floor": "tls12",
"countNoun": "destinations",
"levels": [
{
"id": "tls10",
"label": "TLS 1.0",
"desc": "Deprecated 2021 — prohibited by SP 800-52.",
"count": 1
},
{
"id": "tls11",
"label": "TLS 1.1",
"desc": "Deprecated 2021 — prohibited by SP 800-52.",
"count": 1
},
{
"id": "tls12",
"label": "TLS 1.2",
"desc": "The SP 800-52 minimum for all connections.",
"count": 204
},
{
"id": "tls13",
"label": "TLS 1.3",
"desc": "Recommended — modern ciphers only.",
"count": 861
}
]
}
},
{
"id": "P-TOOL-APPROVAL",
"mode": "observe",
"severity": "medium"
},
{
"id": "P-TOOL-ALLOW",
"mode": "observe",
"severity": "medium",
"config": {
"shape": "list",
"source": "qdash P5 Tool Allow-List",
"title": "Approved tools",
"valueLabel": "Tool",
"placeholder": "tool name or pattern",
"scopes": [
"global",
"agent"
],
"entries": [
{
"value": "Read",
"scope": "global",
"addedBy": "seed",
"lastMatched": "2026-10-09",
"note": "builtin"
},
{
"value": "Write",
"scope": "global",
"addedBy": "seed",
"lastMatched": "2026-10-09",
"note": "builtin"
},
{
"value": "Grep",
"scope": "global",
"addedBy": "seed",
"lastMatched": "2026-10-09",
"note": "builtin, read-only"
},
{
"value": "Glob",
"scope": "global",
"addedBy": "seed",
"lastMatched": "2026-10-09",
"note": "builtin, read-only"
},
{
"value": "WebFetch",
"scope": "global",
"addedBy": "seed",
"lastMatched": "2026-10-09",
"note": "builtin, read-only"
},
{
"value": "Bash",
"scope": "agent",
"addedBy": "seed",
"lastMatched": "2026-10-08",
"note": "ci harnesses only"
}
]
}
},
{
"id": "P-PROMPT-INSPECT",
"mode": "observe",
"severity": "medium",
"config": {
"shape": "detectors",
"source": "qdash P12 Prompt Inspection",
"title": "Injection heuristics",
"families": [
{
"name": "Injection heuristics",
"detectors": [
{
"label": "Instruction override",
"severity": "medium",
"hits": 0,
"on": true,
"note": "\"ignore previous instructions\" family"
},
{
"label": "Role confusion",
"severity": "medium",
"hits": 0,
"on": true
},
{
"label": "System-prompt probe",
"severity": "high",
"hits": 0,
"on": true
},
{
"label": "Encoded payload",
"severity": "medium",
"hits": 0,
"on": false,
"note": "base64/hex smuggling — experimental"
}
]
}
]
}
},
{
"id": "P-CREDENTIALS",
"mode": "observe",
"severity": "critical",
"config": {
"shape": "detectors",
"source": "qdash P9 Data Redaction (Secrets)",
"title": "Credential detectors",
"families": [
{
"name": "Secrets",
"detectors": [
{
"label": "AWS access key",
"severity": "high",
"hits": 0,
"on": true
},
{
"label": "Private key (PEM)",
"severity": "high",
"hits": 0,
"on": true
},
{
"label": "OAuth token",
"severity": "medium",
"hits": 0,
"on": true
},
{
"label": "Generic API key",
"severity": "medium",
"hits": 0,
"on": false,
"note": "higher false-positive rate"
}
]
}
]
}
},
{
"id": "P-PROVENANCE",
"mode": "off",
"severity": "medium",
"config": {
"shape": "list",
"source": "qdash P14 Provenance Pinning",
"title": "Pinned versions",
"valueLabel": "Server or skill",
"placeholder": "name@version",
"scopes": [],
"entries": []
}
},
{
"id": "P-OUTPUT",
"mode": "observe",
"severity": "high",
"config": {
"shape": "detectors",
"source": "qdash P13 Output Validation",
"title": "Output detectors",
"families": [
{
"name": "Output detectors",
"detectors": [
{
"label": "Secret echo",
"severity": "high",
"hits": 0,
"on": true,
"note": "credentials reflected back in output"
},
{
"label": "Unsafe command",
"severity": "medium",
"hits": 0,
"on": true,
"note": "destructive shell patterns"
},
{
"label": "Malformed structured output",
"severity": "low",
"hits": 0,
"on": false
}
]
}
]
}
},
{
"id": "P-SANDBOX",
"mode": "observe",
"severity": "high",
"config": {
"shape": "level",
"source": "qdash P7 Sandbox Required",
"title": "Minimum sandbox level",
"floor": "workspace",
"countNoun": "runs",
"levels": [
{
"id": "danger",
"label": "danger-full-access",
"desc": "No confinement — full host access, approvals bypassed.",
"count": 3
},
{
"id": "workspace",
"label": "workspace-write",
"desc": "Writes confined to the workspace; reads unrestricted.",
"count": 41
},
{
"id": "read-only",
"label": "read-only",
"desc": "No writes at all; every mutation needs explicit approval.",
"count": 12
}
]
}
},
{
"id": "P-NO-ROOT",
"mode": "observe",
"until": "2026-11-15T00:00:00Z",
"severity": "high"
},
{
"id": "P-TELEMETRY",
"mode": "observe",
"severity": "medium"
},
{
"id": "P-SPEND",
"mode": "off",
"severity": "low",
"config": {
"shape": "threshold",
"source": "qdash P15 Spend Ceiling",
"title": "Spend ceilings",
"metrics": [
{
"label": "Fleet daily spend",
"scope": "all harnesses · rolling 24h",
"unit": "$",
"value": 25,
"observed": 18
},
{
"label": "Per-person daily spend",
"scope": "each person · rolling 24h",
"unit": "$",
"value": 10,
"observed": 6
}
]
}
}
],
"exceptions": [
{
"id": "E-GRC",
"policy": "P-MCP",
"scope": "team:GRC",
"mode": "off",
"reason": "Approved GRC workflow with the vendor (Vanta MCP).",
"by": "Dana (security admin)",
"at": "2026-09-28T10:00:00Z"
},
{
"id": "E-FIN-MCP",
"policy": "P-MCP",
"scope": "team:Finance",
"mode": "enforce",
"reason": "Regulated data: Finance blocks unsanctioned MCP servers.",
"by": "Dana (security admin)",
"at": "2026-09-24T09:00:00Z"
},
{
"id": "E-ENG-MCP",
"policy": "P-MCP",
"scope": "team:Engineering",
"mode": "observe",
"reason": "Engineering is evaluating MCP servers; observe only while the sanctioned list settles.",
"by": "Dana (security admin)",
"at": "2026-09-26T14:10:00Z"
},
{
"id": "E-FIN-BOUNDARY",
"policy": "P-DATA-BOUNDARY",
"scope": "team:Finance",
"mode": "enforce",
"reason": "PHI lives in Finance; the boundary applies there.",
"by": "Dana (security admin)",
"at": "2026-09-18T11:00:00Z"
},
{
"id": "E-FIN-FILES",
"policy": "P-FILES",
"scope": "team:Finance",
"mode": "enforce",
"reason": "Stricter file controls for regulated data.",
"by": "Dana (security admin)",
"at": "2026-09-18T11:05:00Z"
},
{
"id": "E-ENG-PROV",
"policy": "P-PROVIDERS",
"scope": "team:Engineering",
"mode": "enforce",
"reason": "Engineering ships to production; approved providers only.",
"by": "Dana (security admin)",
"at": "2026-09-22T10:00:00Z"
},
{
"id": "E-JORDAN-PROV",
"policy": "P-PROVIDERS",
"scope": "user:Jordan",
"mode": "observe",
"until": "2026-11-15T00:00:00Z",
"reason": "Evaluating Mistral for the eval harness; observe only until mid-November.",
"by": "Sam (GRC lead)",
"at": "2026-10-07T15:30:00Z"
}
]
}Import
a Policy Config file, read against what you're viewing; its differences stage as edits in this browseror paste below ·