Policies overview
What Alesia policies are, how scope and enforcement work, and how drafts, versions and overlapping policies behave.
A policy is a named set of rules that Alesia enforces on your users' devices. Each policy has a scope, which is who it applies to, and one or more rules, which are what it controls. One policy can mix any rule types.
Find policies under Security → Policies.
Rule types
Rule | What it controls | Guide |
|---|---|---|
Token Limit | Token usage per day, week or month | |
File Upload | Which file types can be uploaded to AI tools | |
Model Restriction | Which models of a provider can be used | |
Egress Rule | Which provider hostnames can be reached | |
Data Protection | Sensitive data in prompts and files, using a DLP model | |
Agent Guardrail | Risky AI agent actions, using a guardrails model |
Data Protection and Agent Guardrail rules need a deployed model first. They are only available on some plans.
Enforcement
Every rule has an enforcement mode:
- Block: refuses the request outright. This is the default.
- Warn: the user is prompted and can continue or cancel.
- Warn and redact (Data Protection only): the user is prompted, and the flagged data is always redacted.
- Watch: the event is logged and the user sees nothing.
Scope
A policy applies to one of:
- Organization: everyone in your org.
- Group(s): members of the selected groups.
- User(s): every device the selected users own, including devices enrolled later.
- Client(s): specific devices.
Token limits always count per device. A limit scoped to a user gives each of that user's devices its own budget.
Create a policy
- Go to Security → Policies and click Create Policy.
- Enter a name and an optional description, then pick a scope.
- Click Add rule, choose a rule type and fill in its fields. Repeat for each rule. Each rule type has its own guide, linked in the table above.
- Click Save. This saves a draft, which is not enforced yet.
- Review the draft and click Deploy. The policy is now Active.
The policy page
Open a policy to see four tabs:
- Overview: the live version, rule count, incidents in the last 30 days and recent versions.
- Configuration: the scope and rules. Use the switch on a rule to turn it off without removing it.
- Incidents: every time a rule fired, with the outcome.
- Versions: every saved and deployed version of the policy.
Drafts, versions and rollback
Editing a live policy creates a draft, and the policy shows Changes pending. The live version keeps being enforced until you deploy the draft. You can also discard the draft.
The Versions tab lists every version. Open an older version to compare it with the live one, or Roll back to it.
Incidents
The Incidents tab lists each time a rule fired, the provider and model involved, and the outcome. A blocked request shows Blocked. A warning the user continued past shows Sent after warning.
When policies overlap
A device can be covered by several policies. For each rule target, exactly one rule wins:
- A rule scoped to the Client beats one scoped to the User, which beats Group, which beats Organization.
- At the same level, the stricter rule wins. Block beats Warn and redact, which beats Warn, which beats Watch.
- For token limits with the same enforcement, the lowest daily rate wins. For example, 200,000 tokens a month (about 6,667 a day) beats 10,000 a day. See Set token limits.
There is no default deny. A device with no active policy is unrestricted. If you disable the only policy that covers a group, that group becomes unrestricted.
Disable or delete
From the options menu on a policy:
- Disable stops enforcement and keeps the policy. Enable it again at any time to enforce its last deployed version.
- Delete removes the policy and all of its versions. This cannot be undone.
Plan limits
The free plan includes one default policy. Upgrade to customize its rules or create more policies.
Need help?
Contact support@getalesia.com.
Was this helpful?
Your feedback shapes what we write next.