Apply policies
Govern what passes through the surface once a caller is authenticated, and what the managed agent can do when it calls external services. OPA policies apply Rego rules at gateway scope (all surfaces) or surface scope (one surface).
| Guide | What you will achieve |
|---|---|
| Use JWT claims to control access to a surface | Add Policy elements to a surface to control which inbound requests reach your managed agent, based on JWT claims, request attributes, or caller context. |
| Control MCP tool access with per-tool policies | Assign Rego policies to individual MCP tools so only callers whose credentials satisfy the policy can invoke each tool. |
| Apply policy to outbound calls | Route your managed agent’s outbound calls through the gateway to apply OPA policy and trust checks before each request leaves. |
| Apply OPA policies to your gateway and surfaces | Create OPA Rego policy definitions and activate them at gateway scope or surface scope to enforce access control. |
Was this page helpful?
Glad to hear it. Thanks for letting us know.
Sorry to hear that. Thanks for letting us know.