Understanding How Access Policies Are Evaluated in Priority Order

Access policies are evaluated from the top of the list downwards. The first policy that matches a request is applied, and no further policies are considered.

Every time an agent calls a tool, AI Security works down the policy list looking for a match. As soon as it finds one, it applies that policy's action and stops. The policies below it never run.

This has two consequences worth understanding before you write policies:

• A broad policy near the top can prevent a more specific policy below it from ever taking effect.
• Reordering policies changes behaviour, even when the policies themselves are unchanged.

As a general rule, place your most specific policies at the top and your broadest policies at the bottom. To change the order of your policies, see Changing the Priority Order of Policies.