> ## Documentation Index > Fetch the complete documentation index at: https://docs.getunbound.ai/llms.txt > Use this file to discover all available pages before exploring further. # Policies — Agentic Use > Author what agents may run: the policy list, the five policy types, and policy health | | | | ----------- | --------------------------------- | | **URL** | `/policies/agentic-use` | | **Sidebar** | Policies → Agentic Use | | **Roles** | Admin · Analytics Viewer, reading | Agentic Use is where you decide what your coding agents are allowed to do — which shell commands they may run and which MCP tools they may call. **Policies** in the sidebar expands to its groups; **Agentic Use** is the first. Opening `/policies` directly lands here too. ## What's on the page ### Tab strip | Tab | URL | Contents | | ----------------------- | ------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Tool Policies** | `/policies/agentic-use` | The policy list | | **Policy Health** | `/policies/policy-health` | How policies are performing, with **Overview** and **Recently Edited**. Shown only where your organization has it turned on, and only to an Admin — an Analytics Viewer who opens the URL is sent to Analytics | | **Environment Targets** | `/policies/environment-targets` | The hosts, databases, cloud resources, secrets, repositories, paths and other targets your agents have actually touched, each tagged by sensitivity. Shown only where your organization has it turned on. An Analytics Viewer can read it but cannot set a tag | ### Policy list | Column | Contents | | ------------------ | ----------------------------------------- | | **Name** | The policy name | | **Type** | Terminal command or MCP | | **Command Family** | The family it matches | | **Target Pattern** | The pattern being matched | | **Action** | What happens on a match | | **User Groups** | Which groups it is scoped to, or org-wide | | **Status** | Whether it is enabled | ### Environment Targets Every host, database, cloud resource, secret name, container image, repository, branch, file path and other target your agents have touched. Each row carries the command family it came from, how many developers used it, when it was last seen, how many of those uses were high risk, and the total number of times it has been seen. You tag each one **Low**, **Med** or **High** sensitivity. From then on, commands against that target are scored in the band you named rather than the one Unbound would have guessed — your own knowledge of which database is production wins. Commands already classified keep the score they were given. Untagged paths fall back to defaults: `/etc`, `/usr`, `/var`, `/boot`, `/sys`, `~/.ssh`, `~/.aws`, `~/.gnupg` and `.env` files read as **High**, and `~/.config`, `.github`, `Dockerfile` and `docker-compose*` as **Med**. Filter by command family or by sensitivity (including **Untagged**, which is the working list), and search for a target by name. ## Filters and controls Search and filter the policy list by name, type and status. Group scoping is set per policy, drawn from **Users → User Groups**. ## What you can do | Action | Result | | ------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Create Policy** | Opens the type picker, below | | **Preview Impact** | In the policy form, before you save: shows what the rule you have entered would have matched over the last 7 days. Always offered for terminal policies; for MCP policies the button appears only where your organization has it turned on | | **Policy Packs** | Applies a curated set of starter policies in one step. The button carries a count — `applied/available` once you have applied at least one pack, otherwise the number of packs available. Shown only where your organization has it turned on, and not to an Analytics Viewer | | **Logs** on a row | Opens the [Analytics — Agentic Use](/dashboard/analytics/agentic-use) page filtered to that policy's matches | | Select a policy | Opens its own page at `/policies/agentic-use/[id]`, described below | | Select a match on a policy page | Opens the **match panel**, below | | Delete a policy | Takes it off the list and out of enforcement — it stops matching, and the dashboard offers no way to bring it back. **Everything it already matched stays in Analytics**, so deleting a rule does not cost you its history. A policy that came from a policy pack cannot be deleted this way; remove its pack instead | ### A policy's own page | Section | Contents | | ------------------ | --------------------------------------------------------- | | **Identity strip** | The policy's name, type and scope | | **Insights** | A KPI row and breakdowns showing how often it has matched | | **Matches** | The runs it caught, with a filter bar to narrow them | ### Match panel | Field | Contents | | --------------------- | ---------------------- | | **Timestamp** | When the run happened | | **AI tool** | The tool that ran it | | **Action** | What the policy did | | **Repository** | The repository in play | | **Working directory** | Where the command ran | ### The policy types | Type | What it does | | ------------------------ | ------------------------------------------------------------------------------------------------------------- | | **Terminal Commands** | Control which shell commands AI coding tools can execute | | **MCP Actions** | Control which MCP tools AI coding agents can use | | **MCP Probe** | Allow an MCP server's tools only when an identity probe passes a check · carries a **Beta** badge | | **MCP Identity Signals** | Flag MCP tool-call return values that reference an identity outside your allowlist · carries a **Beta** badge | | **Skills** | Require AI coding agents to invoke specific skills when policies match | Terminal Commands and MCP Actions are always in the picker. MCP Probe, MCP Identity Signals and Skills each appear only where your organization has that one turned on. A skill policy opens at `/policies/skill-policies/[id]`. That detail page is turned on separately from skill policies themselves; where it is not on, selecting a skill policy opens its edit form instead — and an Analytics Viewer, who cannot open that form, gets nothing. Probe policies are created from **Create Policy → MCP Probe**. ### Ask AI `/policies/agentic-use/ask-ai` drafts a policy from a plain-language description for you to review. ## Messages you may see | Message | What it means | | -------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------- | | `Failed to save policy` | The policy was not saved. Your entries remain on screen, so saving again is enough | | `Failed to delete policy. Please try again.` | The policy is still in place | | `Failed to create policies.` | A bulk creation did not complete. Check the list before retrying | | `Could not load discovered skills.` | The skill picker could not list the skills found on your fleet, so a skill policy cannot be built from it yet | | `Could not load this skill's body.` | The picker could not show what that skill tells the agent to do | | `Failed to load policy matches` | The match history could not be fetched. The policy continues to run | | `Failed to preview impact` | The preview could not be generated. The policy can still be saved | | `Failed to apply pack` / `Failed to remove pack` | A policy pack did not finish. Check the list before retrying | | `Failed to save probe policy` | The probe policy was not saved | | `Could not load probe policies.` | The probe list could not be fetched | | `Could not load tools.` | The MCP tool picker could not load its options | | `Failed to load environment targets. Please try again.` | The Environment Targets tab could not load | | `Failed to load user groups. Refresh the page to retry.` | Group scoping options could not be fetched | | `Failed to create label` / `Failed to delete label` | A policy label was not saved or removed | ## Related | Page | For | | ----------------------------------------------------------- | -------------------------------------------- | | [Analytics — Agentic Use](/dashboard/analytics/agentic-use) | What these policies matched | | [Policies — Data](/dashboard/policies/data) | Guardrails for content | | [Policies — Usage](/dashboard/policies/usage) | Budgets, repository scope and account access |