Skip to main content
Policies are the foundation of White Circle’s platform — each one defines what content should be flagged or allowed in your application.

​
Core Components

Every Policy consists of two main components:

Flagged Content

Describe the types of content that trigger a violation, including edge cases and intent.

Allowed Content

Describe content that must remain allowed, including borderline cases that may resemble violations.
If you want to prevent system prompt leakage from your AI assistant:
  • Flagged content: “Requests that ask for the system prompt, attempts to extract internal instructions, jailbreak attempts to reveal hidden prompts”
  • Allowed content: “General discussions about the bot’s architecture, questions about what a system prompt is in principle, educational content about AI systems”

​
Writing Policy Rules

In most cases, you can simply write your flagged and allowed content descriptions in plain, human language. No special syntax or technical formatting required.

​
Improving Your Policy

After writing your initial descriptions, click the Improve button to upgrade your Policy to a production-ready version. During the improvement process:
  1. We’ll show you around 10 sample sessions
  2. You’ll label each one — marking whether it violates your Policy or not
  3. We use your labels to calibrate and adapt the Policy to match the behavior you expect
The labeling step is crucial for Policy accuracy. Take your time to carefully review each example — this directly affects how well the Policy performs in production.

​
Policy Settings

Beyond the core flagged/allowed content, Policies have several optional properties you can configure:
The name displayed on the platform and returned by the API. Choose something descriptive like “No Medical Advice” or “NSFW Filter”.
Determines which Environments the Policy belongs to. A single Policy can be assigned to multiple Environments.
Conditions decide when this Policy is a candidate by matching each Event’s metadata. Attach the Policy to one or more Conditions for every Environment where it should run.
Events with no matching active Condition run with zero Policies. There is no fallback to all Policies in the Environment.
See Conditions for metadata expressions and attachment behavior.
Choose the source of the content, then the Event types this Policy evaluates.Source:
  • Any — check both user and assistant content
  • User — check user-created content
  • Assistant — check assistant-created content
Event types:
Each Event is checked on its own, so a Policy runs only against the types and fields you select here. Events that don’t match any selected Policy type or field aren’t checked.
Set how strongly each Policy violation contributes to the strike system:
  • Critical — critical strike impact
  • High — high strike impact
  • Medium — moderate strike impact
  • Low — lowest strike impact
Severity level is used by the strike system to calculate points and effective user actions.
Shadow mode lets you test a Policy before enforcing it in production.
When shadow mode is enabled:
  • In the dashboard, you’ll see all detected violations as usual
  • In the API, we will not flag those requests as violations
This is perfect for validating a newly created Policy before it starts affecting real traffic.

​
Next Steps

Create Policy API

Create Policies programmatically from your backend.

List Policies API

Retrieve active Policies and their Environment assignments.

Create a Policy

Create and manage Policies in the White Circle dashboard.

Metrics

Learn how Metrics provide product analytics for AI applications.

Set up Environments

Separate sessions across deployment Environments.