> ## Documentation Index
> Fetch the complete documentation index at: https://docs.whitecircle.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Policies

> Define content moderation rules for your application

export const domain = 'https://eu.whitecircle.com';

Policies are the foundation of White Circle's platform — each one defines what content should be flagged or allowed in your application.

## Core Components

Every Policy consists of two main components:

<CardGroup cols={2}>
  <Card title="Flagged Content" icon="ban">
    Describe the types of content that trigger a violation, including edge cases and intent.
  </Card>

  <Card title="Allowed Content" icon="check">
    Describe content that must remain allowed, including borderline cases that may resemble violations.
  </Card>
</CardGroup>

<Accordion title="Example policy: System prompt leakage prevention">
  If you want to prevent system prompt leakage from your AI assistant:

  * **Flagged content:** "Requests that ask for the system prompt, attempts to extract internal instructions, jailbreak attempts to reveal hidden prompts"
  * **Allowed content:** "General discussions about the bot's architecture, questions about what a system prompt is in principle, educational content about AI systems"
</Accordion>

## Writing Policy Rules

In most cases, you can simply write your flagged and allowed content descriptions in **plain, human language**. No special syntax or technical formatting required.

### Improving Your Policy

After writing your initial descriptions, click the **Improve** button to upgrade your Policy to a production-ready version.

During the improvement process:

1. We'll show you around 10 sample sessions
2. You'll label each one — marking whether it violates your Policy or not
3. We use your labels to calibrate and adapt the Policy to match the behavior you expect

<Tip>
  The labeling step is crucial for Policy accuracy. Take your time to carefully review each example — this directly affects how well the Policy performs in production.
</Tip>

## Policy Settings

Beyond the core flagged/allowed content, Policies have several optional properties you can configure:

<AccordionGroup>
  <Accordion title="Name" icon="tag">
    The name displayed on the platform and returned by the API. Choose something descriptive like "No Medical Advice" or "NSFW Filter".
  </Accordion>

  <Accordion title="Environments" icon="layer-group">
    Determines which [Environments](/latest/first-steps/environments) the Policy belongs to. A single Policy can be assigned to multiple Environments.
  </Accordion>

  <Accordion title="Conditions" icon="filter">
    Conditions decide when this Policy is a candidate by matching each Event's metadata. Attach the Policy to one or more Conditions for every Environment where it should run.

    <Warning>
      Events with no matching active Condition run with zero Policies. There is no fallback to all Policies in the Environment.
    </Warning>

    See [Conditions](/latest/condition/overview) for metadata expressions and attachment behavior.
  </Accordion>

  <Accordion title="What to Check" icon="arrow-right-arrow-left">
    Choose the source of the content, then the Event types this Policy evaluates.

    Source:

    * **Any** — check both user and assistant content
    * **User** — check user-created content
    * **Assistant** — check assistant-created content

    Event types:

    | Event type | What you can select           |
    | ---------- | ----------------------------- |
    | Messages   | Message content               |
    | Artifacts  | Image                         |
    | Reasoning  | Assistant reasoning           |
    | Agents     | Input, Output, Instructions   |
    | Tools      | Definition, Arguments, Output |
    | Functions  | Definition, Arguments, Output |

    <Info>
      Each Event is checked on its own, so a Policy runs only against the types and fields you select here. Events that don't match any selected Policy type or field aren't checked.
    </Info>
  </Accordion>

  <Accordion title="Severity Level" icon="triangle-exclamation">
    Set how strongly each Policy violation contributes to the strike system:

    * **Critical** — critical strike impact
    * **High** — high strike impact
    * **Medium** — moderate strike impact
    * **Low** — lowest strike impact

    <Info>
      Severity level is used by the strike system to calculate points and effective user actions.
    </Info>
  </Accordion>

  <Accordion title="Shadow Mode" icon="moon">
    Shadow mode lets you **test a Policy before enforcing it** in production.

    <Note>
      When shadow mode is enabled:

      * In the **dashboard**, you'll see all detected violations as usual
      * In the **API**, we will **not** flag those requests as violations

      This is perfect for validating a newly created Policy before it starts affecting real traffic.
    </Note>
  </Accordion>
</AccordionGroup>

***

## Next Steps

<CardGroup cols={2}>
  <Card title="Create Policy API" icon="plus" href="/latest/policy/create-policy">
    Create Policies programmatically from your backend.
  </Card>

  <Card title="List Policies API" icon="list" href="/latest/policy/list-policies">
    Retrieve active Policies and their Environment assignments.
  </Card>

  <Card title="Create a Policy" icon="plus" href={`${domain}/policies`}>
    Create and manage Policies in the White Circle dashboard.
  </Card>

  <Card title="Metrics" icon="chart-line" href="/latest/first-steps/metrics">
    Learn how Metrics provide product analytics for AI applications.
  </Card>

  <Card title="Set up Environments" icon="layer-group" href="/latest/first-steps/environments">
    Separate sessions across deployment Environments.
  </Card>
</CardGroup>