Limit what an agent can call
A policy answers one question on every call: can this key call this tool, with these arguments, right now?
Policies live beside the server, not inside your API. Rules evaluate top to bottom and the first match wins; anything unmatched is denied. That default is deliberate. A server that fails open is worse than no server.
Who a rule applies to
Every call arrives with a key, and the key says who is calling, an API key on its own, a named agent, a team, a role. A rule can name several, so one rule can cover your whole staging fleet.
policy operator-write { subjects = [role:operator, team:growth] allow tool:read_* allow tool:update_campaign_budget when amount < 5000 review tool:update_campaign_budget when amount >= 5000 deny tool:delete_* }
What happens on a match
A rule can only take away from what the upstream credential already allows, never add to it. If the token you gave Bridge is read-only, nothing you write here can make a write happen.
Try it against real traffic first
While you are editing a policy in the console, dry run replays your most recent real calls (up to 1,000) against the draft and tells you exactly what would have changed. You find out here, not from a broken agent. Publishing applies to the next request; the policy is read fresh on every call, so nothing is cached and calls already in flight are not interrupted.
200 calls replayed against the draft 184 allow unchanged 11 review was allow 5 deny was allow charges.create allow → review refunds.create allow → deny