Configure policies

Detection decides what gets flagged. Policies decide what happens next. Airentect ships with a default policy that covers everyone, and lets you add group policies with tighter rules for the teams that need them.

Default and group policies

The default policy applies organisation-wide. Every user is covered by it unless a group policy takes over, so there is never a gap where someone has no policy at all.

Group policies add stricter rules on top for specific teams. A finance team might get blocking where the rest of the organisation gets warnings; a support team handling customer records might get redaction on identity data that engineering does not need. Create a group policy when a team's obligations genuinely differ, not for every team you have. Most organisations run well on one default policy and a small number of group policies.

Policy actions

Each risk category in a policy carries one of four actions:

• Audit. The prompt goes through untouched and the event is logged. Use this to build a picture of real usage before you enforce anything.
• Warn. The user sees a warning identifying what was detected and chooses whether to proceed. The decision is logged either way. This changes behaviour without blocking work.
• Redact. The sensitive spans are replaced before the prompt leaves the browser. The user keeps working, the AI tool never sees the sensitive values. This suits data types where the value itself is the problem, such as credentials or identity numbers.
• Block. The prompt does not go. Reserve this for the categories where exposure is never acceptable.

A sensible first rollout is audit everywhere for a week or two, then warn on the categories that matter, then redact or block where the logs show real exposure. Jumping straight to block on day one generates friction before you have the evidence to justify it.

Controls

The Controls tab is where actions are set, one per risk category. Categories cover areas such as credentials and secrets, personal identity data, source and build artefacts, and operational confidential material. Each category can have a different action, so blocking secrets does not force you to block everything else.

Entities

The Entities tab manages specific data types, such as credentials, payment card numbers, and tax file numbers. Where controls work at the level of risk categories, entities let you tune the treatment of individual identifier types. The entity list is jurisdiction-aware, so the identifier names for your country from your detection profile appear alongside the generic types.

Assignment and testing

The Assignment tab attaches a group policy to one or more groups. Group membership is managed under Users, and assignment is what makes a policy apply to a person, so check it whenever a policy does not seem to fire for someone you expected it to.

The Test tab runs a real prompt through this specific policy and shows the outcome: what was detected and which action the policy would take. Test each policy with a prompt that should trigger it and one that should pass, before any endpoints depend on it.

Warning: Policies enforce at the moment a prompt is sent. Changes take effect for new prompts as soon as you save, so make edits to blocking rules deliberately during working hours, not as an experiment on a Friday afternoon.