policy tool subcommand.
Listing and inspecting policies (list, get, form-data, and the policy tool list, get, families and mcp-servers commands) needs Admin or Analytics Viewer. Creating, updating and deleting policies, including --prompt AI assist, needs Admin; an Analytics Viewer gets Admin access required.
Reference data
Before creating policies, pull the available user groups, models, guardrails, and tool types:Generic commands (Cost / Security)
Use the type-specific commands —
policy cost create, policy security create, and the policy tool family below — for guided, flag-based create and update. Each also has an update <id> that changes only the fields you pass.list too, with columns tuned to that type. The cost and security lists take --json and nothing else; policy tool list also filters and pages, as shown below. The --enabled filter lives only on policy list:
Cost policies
Set a monthly spend limit per user group:policy security create, with one difference in how they resolve: every matching security policy applies, and the strictest action wins for each guardrail. For cost policies, one policy wins outright — the one with the lowest priority number.
See Cost Policies for all configuration options.
Security policies
Apply guardrails for PII and secrets detection:--guardrail takes <name>:<action>[:<threshold>] and is repeatable. The guardrails are PII and Secrets; each supports the actions BLOCK and AUDIT. unbound policy form-data lists them with their allowed actions. The optional third part is the threshold — the guardrail acts only once that many instances are found in one request. It defaults to 1, and the CLI accepts 1 to 100:
unbound policy form-data for the guardrail names available to you.
See Security Policies for all configuration options.
Tool policies
Tool policies control shell commands and MCP tool calls. They have their own command group,unbound policy tool, rather than sharing the generic policy commands — unbound policy list, get and delete cover Cost and Security only, and each one’s --help says so.
List and inspect
Discover available targets
Create a terminal command policy
--command-family takes a family name, and --field takes a field that family accepts. Families are grouped into categories — filesystem, cloud, database, network and the rest — and a category is not a family: --command-family filesystem comes back Unknown command family: filesystem. The families under filesystem are read_file, write_file and delete_file, which is why the example above targets delete_file. Run unbound policy tool families for the families your organization can target and the fields each one accepts, or see Command family reference.
To match the whole raw command line instead of a field, use the custom family, below.
Describe it in plain English
If you don’t know the family or the field to match on, describe what you want and let Unbound author the policy:--prompt run creates exactly one policy, so describe one rule at a time. Add --yes to skip the confirmation (the preview still prints), or --no-ai to use the raw classification flags instead.
--prompt can’t be combined with --command-family, --field, or --config. You can still pass --name, --description, --action, --custom-message, --group, --disabled, --yes and --json.
create-terminal and create-mcp need you to pick a mode: either --prompt "<description>" for AI assist, or --no-ai to pass the raw classification flags. Running either with neither exits 2.--no-ai is refused when the CLI detects it is running inside Claude Code, to steer agents toward AI assist. Set UNBOUND_ALLOW_NO_AI_UNDER_CLAUDE=1 if you’re driving the terminal yourself.Whenever the resolved action is BLOCK or WARN, --custom-message is required — those policies always need a user-facing message.Match a command we don’t classify
Most commands fall into a family (delete_file, cloud_destroy, git_action, …). When yours doesn’t, or you want to match one exact command rather than a category, use the custom family and give it the whole command pattern:
custom takes a single command field — the pattern is matched against the whole command line, and it is the only key a custom policy may carry. Run unbound policy tool families to see every family and the fields each one accepts.
A custom pattern that reads as a regex cannot use lookahead ((?=, (?!), lookbehind ((?<=, (?<!), atomic groups ((?>) or backreferences (\1–\9, \k<name>) — those are refused at create time with Invalid pattern: …. Rewrite without them, or use an exact or *-wildcard pattern, which are matched literally and not checked this way. Ordinary field patterns have no such restriction.
Create an MCP tool policy
BLOCK, WARN, AUDIT, REQUIRE_SLACK_APPROVAL
Update a tool policy
Only the fields you pass are changed:
The cost and security policy types each have an
update <id> too. policy cost update takes --monthly-budget plus --name, --group, --priority and --enabled / --disabled. policy security update takes those shared flags, but guardrail and routing changes go through --config '<json>' — the create-time --sub-type / --guardrail / --route flags aren’t accepted on update:
See Tool Policies for the full list of actions, NL rules, and canonical group targeting. Every list, get, create and update command supports
--json for machine-readable output. delete doesn’t — it takes only --yes.
Tool Policies
Dashboard reference for actions, NL rules, and Slack approvals
Cost Policies
Dashboard reference for budget limits and spend controls