Policy Templates¶

Vargate includes five pre-built policy templates for common use cases. Each template is a parameterized OPA/Rego policy with configurable defaults that you can override via policy_config.

Available Templates¶

Template	Use Case	Key Rules
General	Default for any agent	Action limits, anomaly detection, destructive action approval
Financial	Payment, transfer, billing agents	Transaction limits, currency enforcement, approval thresholds
Email	Outreach, marketing, comms agents	Send limits, consumer domain blocking, AI disclosure
CRM	Sales, CRM, pipeline agents	Bulk operation limits, field restrictions, export approval
Data Access	ETL, analytics, data pipeline agents	Row limits, PII controls, data residency

Applying a Template¶

List Templates¶

curl https://vargate.ai/api/policy/templates \
  -H "X-API-Key: YOUR_KEY"

Apply a Template¶

curl -X PATCH https://vargate.ai/api/dashboard/settings \
  -H "Content-Type: application/json" \
  -H "X-API-Key: YOUR_KEY" \
  -d '{"policy_template": "financial"}'

Override Defaults¶

Each template has configurable parameters. Override them with policy_config:

curl -X PATCH https://vargate.ai/api/dashboard/settings \
  -H "Content-Type: application/json" \
  -H "X-API-Key: YOUR_KEY" \
  -d '{
    "policy_template": "financial",
    "policy_config": {
      "transaction_limit": 10000,
      "approval_threshold": 5000
    }
  }'

How Config Overrides Work¶

Templates use the OPA object.union pattern: your policy_config values are merged with the template defaults. Any key you provide overrides the default. Keys you don't provide keep the default value.

Final Config = Default Config + Your Overrides

For example, the financial template defaults to transaction_limit: 5000. If you set policy_config: {"transaction_limit": 10000}, only that value changes — all other defaults remain.

Managed Agent Policies¶

If you're governing Anthropic managed agents, see the dedicated Managed Agent Policy Templates for patterns specific to managed agent sessions, including read-only agents, approval-gated communication, budget-capped sessions, and PII-sensitive environments.