Configure detection policies

Policies is the catalog of implemented detection rules and their organization-specific configuration. Every rule operates in Monitor mode. Policies produce findings; they do not block an agent, tool call, repository change or deployment.

Review a rule

Select a rule to see its ID, title, category, description, scope, current version, last evaluation and open findings. Read its parameters and defaults before changing them. Some rules have no editable parameters because their detection condition is fixed.

The catalog includes MCP configuration, coding-agent permission and GitHub Actions checks, plus the remote MCP authentication probe. See the rule reference for a concise inventory.

Change a policy

Admin or Owner is required to edit policies.

1. Select the rule.
2. Change its enabled state, owner or supported parameters.
3. Enter a specific reason for the change.
4. Run Dry run and review validation messages and the reported effect on current findings and assets.
5. Save a new version or discard the draft.

Dry run previews the supported policy effect; it does not send active test traffic or rerun an entire repository scan. Run the applicable assessment after saving when you need fresh source-backed results.

History and conflicts

Policy history records versions, actors, reasons and effective times. Preserve a reason meaningful to another reviewer, such as an approved narrower sensitive-path list, rather than only “updated”.

Optimistic concurrency protects against silently overwriting another editor. If a save conflicts, reload the current version, compare the change and retry intentionally.

Avoid hiding gaps

Disabling a rule changes what ModelFence evaluates; it does not remove the underlying risk. Record your reason and review Coverage alongside the policy decision. Use risk acceptance on an individual finding when that better expresses a time-bounded exception.