> ## Documentation Index
> Fetch the complete documentation index at: https://quintsecurity.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# policy.proto

> PLANNED — not shipped. No policy.proto exists in the codebase.

<Warning>
  **This schema does not exist.** There is no `policy.proto` in any Quint repository,
  and `PolicyConfig`, `ServerPolicy`, `ToolRule` and `ScoringPolicy` appear in zero
  `.proto` files. Verified 2026-08-09 against `origin/main` of every repo: the only
  protos that exist are `quint/events/v1/agent_action.proto` and
  `quint/events/v1/scoring.proto`, and the latter defines `ScoringConfig` — a
  different message with a different shape.

  This page describes a **planned** design. It is kept, clearly labelled, rather
  than deleted, so the intended shape stays on the record — but nothing here is
  implemented and no client should be written against it.

  For what policy delivery actually does today, see
  [Policies API](/api/policies).
</Warning>

# policy.proto

Hierarchical policy configuration: `PolicyConfig → ServerPolicy → ToolRule`. Supports glob wildcards for flexible server and tool matching.

## PolicyConfig

Top-level configuration for the Quint proxy.

```mermaid theme={null}
flowchart TD
    PC["`PolicyConfig`"] --> SP1["`ServerPolicy (github-*)`"]
    PC --> SP2["`ServerPolicy (postgres-*)`"]
    SP1 --> DA1["`default: ALLOW`"]
    SP1 --> TR1["`create_* → DENY`"]
    SP1 --> TR2["`list_* → ALLOW`"]
    SP2 --> DA2["`default: DENY`"]
    SP2 --> TR3["`query → ALLOW`"]
    PC --> SCR["`ScoringPolicy`"]
    SCR --> SF["`sensitive_fields`"]
    SCR --> BP["`blocked_action_patterns`"]
```

## ServerPolicy

Per-MCP-server access control rules.

```protobuf theme={null}
message ServerPolicy {
  string server = 1;            // Server wildcard (e.g., "github-*")
  Action default_action = 2;    // ALLOW or DENY by default
  repeated ToolRule tools = 3;  // Per-tool rules
}
```

## ToolRule

Per-tool access control within a server policy.

```protobuf theme={null}
message ToolRule {
  string tool = 1;              // Tool wildcard (e.g., "create_*")
  Action action = 2;            // ALLOW or DENY
}
```

## ScoringPolicy

Risk scoring engine policies — maps directly to the infra API's policy schema.

```protobuf theme={null}
message ScoringPolicy {
  repeated string sensitive_fields = 1;
  repeated string allowed_tools = 2;
  repeated string blocked_actions = 3;
  repeated string allowed_action_patterns = 4;   // Glob patterns
  repeated string blocked_action_patterns = 5;   // Override allowed
  repeated DataClassification sensitive_classifications = 6;
  string custom_rules = 7;                        // JSON-encoded
}
```

## Policy Hierarchy

```
PolicyConfig
  ├── ServerPolicy ("github-*")
  │   ├── default_action: ALLOW
  │   ├── ToolRule ("create_*") → DENY
  │   └── ToolRule ("list_*") → ALLOW
  ├── ServerPolicy ("slack-*")
  │   ├── default_action: ALLOW
  │   └── ToolRule ("send_message") → ALLOW
  └── ScoringPolicy
      ├── blocked_action_patterns: ["data:field:pii_sensitive.*"]
      └── sensitive_classifications: [PII_SENSITIVE, FINANCIAL]
```

**Wildcard matching:**

* `*` matches any single segment
* Server/tool names are matched against the pattern
* `blocked_action_patterns` takes precedence over `allowed_action_patterns`