Apply policies
Govern what passes through the surface once a caller is authenticated, and what the managed agent can do when it calls external services. OPA policies apply Rego rules at gateway scope (all surfaces) or surface scope (one surface).
| Guide | What you will achieve |
|---|---|
| Use JWT claims to control access to a surface | Add Policy elements to a surface to control which inbound requests reach your managed agent, based on JWT claims, request attributes, or caller context. |
| Control MCP tool access with per-tool policies | Assign Rego policies to individual MCP tools so only callers whose credentials satisfy the policy can invoke each tool. |
| Apply policy to outbound calls | Route your managed agent’s outbound calls through the gateway to apply OPA policy and trust checks before each request leaves. |
| Apply OPA policies to your gateway and surfaces | Create OPA Rego policy definitions and activate them at gateway scope or surface scope to enforce access control. |
Was this page helpful?
Glad to hear it! Please tell us how we can improve more.
Sorry to hear that. Please tell us how we can improve.
Thank you for sharing your feedback so we can improve your experience.