Tool Policies on Writes and Synced Reads

Label rules in Tool Policies now run on writes as well as reads, so a rule can refuse a write that sets a field labelled compensation above a cap. Synced reads from Deep Query now follow the rules on the action they copy, and a policy that governs a live call governs its synced copy the same way.

What’s new

• Refuse writes by label. The rule builder’s Add statement menu offers Refuse writes by label, which refuses a create or update when a labelled field breaks the rule.
• Labels on written fields. The policy tester and the policy assistant label the fields in a write, so a rule can be checked against a sample request before it is enforced.
• Shape, never value. The classifier labels a field from its shape and never reads the value it holds.
• Synced reads follow live rules. {action}_s1query tools, POST /actions/rpc/synced and MCP execute apply the rules on the action they copy. A refusal returns the same 403 as a live call and shows on the log row.
• Withheld fields stay out of queries. A query that filters, sorts or aggregates on a field a policy withholds is refused with the field named, and queryable_fields no longer lists those fields.
• Same masking as live calls. Masked fields in synced results match live responses, and policyMetadata sits beside result.
• Queries respect Redact PII. When a Redact PII rule covers a class, filters, sorts and aggregations on fields other than numbers and booleans are refused, so a query cannot match against redacted text.

The Tool Policies docs cover the rule builder and the tester. These rules build on the tool and field rules from the first Tool Policies release, and the Deep Query entry explains how synced reads and {action}_s1query tools work.