Skip to main content

Policies Overview

Policies in Helmet provide fine-grained control over MCP server access and tool usage. They act as a security layer between AI applications and your infrastructure, ensuring safe and compliant operations.

Understanding Policies​

What are Policies?​

Policies are sets of rules that govern:

  • Which tools can be accessed
  • Who can use specific functions
  • When operations are permitted
  • How resources are consumed
  • What data can be accessed

Policy Components​

Each policy consists of:

  • Name: Unique identifier
  • Description: Purpose and scope
  • Rules: Specific controls and restrictions
  • Priority: Order of evaluation
  • Scope: Where the policy applies

Policy Types​

Global Policies​

Apply across all servers and users:

  • Organization-wide security standards
  • Compliance requirements
  • Default restrictions
  • Baseline protections

Server Policies​

Specific to individual MCP servers:

  • Server-specific tool restrictions
  • Custom rate limits
  • Access controls
  • Resource quotas

User Policies​

Apply to specific users or groups:

  • Role-based access control
  • Department restrictions
  • Individual permissions
  • Training requirements

Tenant Policies​

For multi-tenant environments:

  • Isolation boundaries
  • Resource allocation
  • Data segregation
  • Custom rules per tenant

Creating Policies​

Basic Policy Creation​

  1. Navigate to the Policy section
  2. Click "Add Policy"
  3. Configure policy settings:
    • Name and description
    • Scope and priority
    • Enabled status

Policy Rules​

Add rules to control:

  • Tool access permissions
  • Parameter restrictions
  • Rate limiting
  • Time-based access
  • Conditional logic

Policy Rules in Detail​

Tool Access Rules​

Control which tools can be used:

  • Allow/Deny: Permit or block tool access
  • Tool Patterns: Wildcard matching for tool names
  • Conditions: Context-based restrictions

Parameter Constraints​

Validate tool parameters:

  • Required values
  • Allowed ranges
  • Pattern matching
  • Type validation
  • Size limits

Rate Limiting​

Prevent abuse through:

  • Calls per minute limits
  • Concurrent request caps
  • Quota management
  • Burst allowances
  • Reset windows

Time-Based Rules​

Schedule-aware policies:

  • Business hours only
  • Maintenance windows
  • Time zone considerations
  • Holiday schedules
  • Temporary access

Policy Evaluation​

Evaluation Order​

Policies are evaluated in sequence:

  1. Priority order (highest first)
  2. Scope specificity (user > server > tenant > global)
  3. First matching rule wins
  4. Default action if no match

Rule Precedence​

Within a policy:

  • Deny rules take precedence
  • More specific rules override general
  • Explicit beats implicit
  • Most restrictive wins

Conflict Resolution​

When policies conflict:

  • Higher priority policies win
  • More specific scope prevails
  • Deny always overrides allow
  • Audit conflicts for review

Policy Management​

Viewing Policies​

The policy dashboard shows:

  • All active policies
  • Rule counts
  • Last modified dates
  • Effectiveness metrics
  • Conflict warnings

Editing Policies​

Modify existing policies:

  • Add or remove rules
  • Adjust priorities
  • Change scope
  • Update descriptions
  • Enable/disable

Testing Policies​

Before deployment:

  • Simulation mode
  • Test scenarios
  • Impact analysis
  • Rollback planning
  • Gradual rollout

Common Policy Patterns​

Security Policies​

Protect against common threats:

  • Block dangerous tools
  • Prevent data exfiltration
  • Limit system access
  • Enforce encryption

Compliance Policies​

Meet regulatory requirements:

  • Data residency rules
  • Audit logging
  • Access controls
  • Retention policies
  • Privacy protection

Policy Enforcement​

Real-time Enforcement​

Policies are applied:

  • During tool calls
  • Before execution
  • With immediate effect
  • Without service disruption
  • With full audit trail

Monitoring Enforcement​

Track policy effectiveness:

  • Block events
  • Allow statistics
  • User feedback
  • Compliance metrics

Violation Handling​

When policies block actions:

  • Clear error messages
  • Audit log entries
  • Alternative suggestions
  • Escalation paths

Best Practices​

Policy Design​

Create effective policies:

  • Start restrictive, relax gradually
  • Document reasoning
  • Regular reviews
  • Test thoroughly
  • Monitor impact

Next Steps​