Your First Policy

Overview

This guide walks you through creating a governance policy from scratch -- from deciding what to govern, to generating rules, binding the policy to an integration, and testing it with a live evaluation. By the end, you will have a working policy that detects PII in AI responses and blocks them from reaching users.

Step 1: Plan Your Policy

Before opening the dashboard, decide what you are governing. For this guide, we will detect personally identifiable information (PII) in AI-generated responses -- specifically Social Security Numbers -- and flag harmful content where the AI oversteps its role.

Aguardic policies support two rule types:

• Deterministic rules use field-level conditions with operators (CONTAINS, MATCHES, EQUALS, etc.). They evaluate in milliseconds with no external calls. Use them for pattern matching, keyword detection, and structured checks.
• Semantic rules use an LLM to evaluate content against a natural language prompt. They handle nuance -- tone, intent, context -- that field operators cannot express. Use them for subjective or context-dependent checks.

Most real-world policies combine both types. Deterministic rules catch the obvious cases fast; semantic rules catch the subtle ones.

Step 2: Create the Policy

Navigate to Policies in the sidebar and click Create Policy. You will see three options:

Option A: AI Assistant (recommended for this guide)

Select AI Assistant. In the chat panel, describe what you need:

"Create a PII detection policy that catches Social Security Numbers using a regex pattern, and add a semantic rule to flag AI responses that give medical advice, legal recommendations, or financial guarantees."

The assistant generates your policy with both rule types:

• A deterministic rule (SSN Detection, severity CRITICAL) with a MATCHES condition on the content field using the pattern \d{3}-\d{2}-\d{4}.
• A semantic rule (Harmful Content Check, severity HIGH) with a prompt that instructs the LLM to flag content where the AI oversteps its role.

You can continue the conversation to refine rules, adjust severity levels, or add more conditions. The generated policy appears in the preview panel on the right, and you can edit the JSON directly if you prefer.

Option B: Document Import

If you have existing compliance documentation (PDF, TXT, DOCX), select Document Import instead. Upload your documents, optionally provide extraction instructions (e.g., "Focus on data privacy rules"), and click Extract Rules. Aguardic reads the documents and generates policy rules automatically -- both deterministic and semantic -- based on the content.

Document Import can extract multiple policies from a single set of documents. You can select which ones to keep, merge them, or re-extract with different instructions.

Step 3: Understanding the Generated Rules

Whether you used the AI Assistant or Document Import, your policy now contains rules. Here is what each type does:

Deterministic rules

The SSN Detection rule fires whenever the content field matches the pattern \d{3}-\d{2}-\d{4} (three digits, dash, two digits, dash, four digits). Because it uses a regex operator, it catches any SSN-formatted string regardless of surrounding text.

Deterministic rules can have multiple conditions -- all must match for the rule to fire. For example, you could add a second condition to only flag SSNs when the role field equals assistant, so user messages are not flagged.

Semantic rules

The Harmful Content Check rule sends the evaluation input to an LLM along with the prompt. The LLM determines whether the content violates the prompt and returns an explanation. Unlike deterministic rules, semantic rules can understand context, detect hedging vs. assertion, and distinguish between informational content and prescriptive advice.

You can optionally attach a knowledge base to a semantic rule. This grounds the LLM evaluation in your organization's own documents using RAG -- useful for checking content against internal guidelines, product documentation, or regulatory text.

Step 4: Set Enforcement Mode

In the next step of the wizard, set the enforcement mode to MONITOR_ONLY for now (we will change this later).

Enforcement modes control what happens when a violation is detected:

Step 5: Bind the Policy to an Integration

In the binding step of the wizard, connect your policy to an integration. Policies are only evaluated when they are bound to an integration -- this controls exactly which policies apply to which endpoints.

Select the integration you want to govern (e.g., your REST API or Agent integration). If you have not created one yet, see the Quickstart guide.

When an evaluation request arrives via that integration's API key, all bound policies are automatically evaluated against the input. You can bind multiple policies to a single integration, and bind a single policy to multiple integrations.

Step 6: Review and Publish

In the final step, review your policy configuration -- name, rules, enforcement mode, and bindings -- then publish. You can choose to activate the policy immediately or save it as a draft.

Step 7: Test Your Policy

Use the evaluate endpoint to send test content and see your policy in action.

Test the deterministic rule

curl -X POST https://api.aguardic.com/v1/evaluate \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "input": {
      "role": "assistant",
      "content": "Sure, my SSN is 123-45-6789. Let me know if you need anything else."
    },
    "targetKey": "pii-test"
  }'

Expected response (with MONITOR_ONLY enforcement, the outcome is still ALLOW but violations are recorded):

{
  "success": true,
  "statusCode": 200,
  "data": {
    "outcome": "ALLOW",
    "enforcementAction": "ALLOW",
    "evaluationRunId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
    "sessionId": null,
    "reviewRequestId": null,
    "pollUrl": null,
    "violations": [
      {
        "id": "f1e2d3c4-b5a6-7890-abcd-ef1234567890",
        "ruleId": "rule-1",
        "ruleName": "SSN Detection",
        "severity": "CRITICAL",
        "resolvedAction": "LOG",
        "explanation": "Content matches SSN pattern (\\d{3}-\\d{2}-\\d{4})",
        "field": "content",
        "snippet": "123-45-6789"
      }
    ]
  }
}

Notice that the outcome is ALLOW because the enforcement mode is MONITOR_ONLY. The violation is still captured in the audit trail -- you just are not blocking anything yet.

Test the semantic rule

curl -X POST https://api.aguardic.com/v1/evaluate \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "input": {
      "role": "assistant",
      "content": "Based on your symptoms, you should take 500mg of ibuprofen twice daily and skip your next appointment. I guarantee this will resolve your condition within a week."
    },
    "targetKey": "harmful-content-test"
  }'

The semantic rule will flag this because the AI is giving specific medical advice, recommending dosages, and making outcome guarantees -- all things a responsible AI should not do.

Test with the SDK

import Aguardic from "@aguardic/sdk";
 
const aguardic = new Aguardic(process.env.AGUARDIC_API_KEY);
 
const result = await aguardic.evaluate({
  input: {
    role: "assistant",
    content: "My SSN is 123-45-6789",
  },
  targetKey: "pii-test",
});
 
if (result.violations.length > 0) {
  console.log("Violations detected:", result.violations);
  console.log("Outcome:", result.outcome);
} else {
  console.log("Content approved");
}

Step 8: Review Violations

Navigate to Violations in the dashboard to see the results of your test evaluations. Each violation shows:

From here you can acknowledge, resolve, or dismiss violations. See the Audit Trail guide for the full investigation workflow.

Step 9: Promote to Enforcement

Once you are satisfied that the policy is catching real issues without too many false positives:

1. Open the policy in the dashboard.
2. Change the enforcement mode from MONITOR_ONLY to WARN (violations are surfaced to your team but actions proceed).
3. Monitor for a period. When confident, switch to BLOCK (actions are prevented when violations are detected).

Each enforcement mode change takes effect immediately for all new evaluations.

Next Steps

• Core Concepts -- Understand policies, rules, conditions, and evaluations in depth
• Evaluation Sessions -- Group evaluations for multi-step workflows
• Evaluate API -- Full API reference for the evaluate endpoint
• AI Systems -- Register AI systems and link policies to integrations