Tool Policies: Semantic Rules, PII Redaction and the Policy AI Assistant

Tool Policies now check the data going into and out of a tool call, as well as the tool itself. Semantic rules and PII redaction run on the inputs before the tool executes and on the response before the agent sees it. The Policy AI Assistant drafts each rule for an admin to review. Tool rules, field rules, value rules and audiences from the first Tool Policies release work as before.

What’s new

• Semantic rules. Write a rule as a question, such as “Does this message contain unreleased financial results?”. A decision model answers it for each field or payload, so the rule holds whatever a system calls the field.
• PII redaction on inputs and outputs. StackOne’s own model finds email addresses, phone numbers, SSNs and card numbers in tool inputs and responses. In Enforce, a rule redacts the detected span or blocks the call; Monitor only records the detection without changing the call.
• Policy AI Assistant. The admin describes the rule and the assistant drafts it in the form for review. It looks up groups, connectors, tools and linked accounts as it writes, and flags what a pattern might miss, such as a connector that names its delete tools remove.
• Policies from request logs. Open a logged call and choose Use in policy. The assistant starts from that call’s tool, connector and caller.
• Semantic rule and PII decisions in the logs. Request logs record each semantic rule and PII check next to tool, field and value rules, in Monitor only and Enforce.

PII detection accuracy

On 247 Connector PII field values, the PII model scored 97.9% span F1 against 68.1% for Microsoft Presidio. On 129 connector field values with no PII, it flagged 3.1% as PII against 48.8%. The PII Redaction page covers the full benchmark.

How a call is checked

Policies apply to calls that carry a member’s identity, such as OAuth and AI platform sessions; project API key calls are not governed. StackOne resolves their groups and evaluates the project’s policies in Cedar before the call reaches the provider. Policies only narrow existing access, and a deny always wins. A blocked input refuses the whole request, and redaction replaces only the detected span.

Set up a rule under Project Settings > Policies, as the Tool Policies docs describe. The Tool Policies page walks through the launch examples, starting with one *delete* rule for a Contractors group. Groups keeps policy audiences in step with your directory.

Availability

• Included in the Gateway Team and Gateway Enterprise plans. See pricing.