> ## Documentation Index > Fetch the complete documentation index at: https://docs.kontext.security/llms.txt > Use this file to discover all available pages before exploring further. # Add a policy > Add a preset, check what it would block, and enforce it. Use an owner or admin account. You need at least one endpoint that reports tool calls so Kontext can check the policy against them. ## 1. Pick a preset Open **Authorization → Policies** and click **New policy**. The picker asks "What should be blocked?" Search or browse presets by category. Click **Add** beside a preset. The picker shows the status of presets you already added. Selecting one opens its row. To write your own rule, use **Write your own** at the bottom of the picker. See [custom policies](/policies/custom-policies). ## 2. Choose the scope The policy drawer has two fields. **Agents** contains Claude Code and Codex. The Claude Code scope includes Claude Cowork. **Endpoints** includes every endpoint by default. Remove entries to limit the policy to one agent or specific endpoints. Kontext has not saved the policy yet. The following GitHub write presets also add **Block unrecognized GitHub operations**: * **GitHub read only** * **Protect Git history** * **Require human merge** * **Protect releases and workflows** * **Protect repository settings** The drawer tells you when Kontext will add this companion as a separate policy in **Observing**. Once enforced, the companion blocks GitHub calls Kontext cannot classify. Those calls would otherwise bypass the preset. Review both policies, then click **Enforce** on each. Enforcing the selected preset does not enforce its companion. ## 3. Observe Click **Observe** to add the policy to **Observing** without blocking calls. Its row shows how many calls it would block in the selected window. Choose a 7, 14 or 30-day window in the top card. Open the row to review matching calls under a heading such as "Would have blocked 3 calls · Last 7 days". Check that you want to block each call. A zero count does not prove that the policy would block nothing. Replay can skip calls with missing input or request evidence. For input-dependent rules, enable **Full payloads** before collecting new test calls. Review those calls before enforcing. ## 4. Enforce Click **Enforce** on the row or in its drawer to move the policy to **Enforced**. Its count now reads "blocked". Your first enforced policy switches the workspace from Observe to Enforce mode. Endpoints start blocking on their next check-in, about once a minute. Check that [Explore](/explore/overview) shows Deny for new matching calls. [Rollout and failure behavior](/policies/rollout) explains the top card's badges while endpoints apply the change. ## Presets | Preset | Blocks | | ---------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------- | | **Block GitHub force pushes** | `git push` with `-f`, `--force`, `--mirror` or a `+` refspec, and GitHub API ref updates with `force=true`. It allows `--force-with-lease`. | | **GitHub read only** | Remote writes through `git push`, mutating `gh` and GitHub API calls, and GitHub MCP server write tools. | | **Block unrecognized GitHub operations** | `gh`, `gh api` and GitHub `curl` routes Kontext cannot classify, and GitHub MCP tools it does not know. | | **Protect Git history** | Force pushes including `--force-with-lease`, remote branch and tag deletion, and tag moves. The policy allows ordinary pushes. | | **Require human merge** | Merging pull requests and turning on auto-merge. Agents can still open, update and review them. | | **Protect releases and workflows** | Creating, editing and deleting releases, and running, cancelling or rerunning GitHub Actions workflows. | | **Protect repository settings** | Changes to repository settings, branch protection, access, secrets, variables, webhooks and deploy keys. | | **Block pull-request creation** | The GitHub MCP tool that opens pull requests. The policy does not cover `gh pr create` in the shell. | | **Block shell commands** | Every shell command. | | **Block direct Python commands** | `python` and `python3` as the command's program. The policy does not cover runners such as `uv run python`. | The shell-based presets read the command as written. They cannot identify operations behind aliases, variables, `xargs`, `sh -c` or scripts. GitHub presets also miss GitHub Enterprise hosts and API bodies from files. The [policy API](/api/policies) lists each preset's coverage and known gaps. ## Change a policy Open the policy's row. Kontext deploys each change when you click its button. | To | Do this | | -------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Change the scope | Edit **Agents** or **Endpoints**, then click **Save**. An enforced policy stays enforced. Each endpoint applies the new scope after fetching the updated policy. | | Change the rule | Expand **Cedar**, click **Edit**, then **Save**. An enforced policy shows **Save to Observing** instead. Kontext keeps the edit in **Observing** with the **Changed** label until you click **Enforce** or **Discard change**. | | Undo your edits to a preset | Click **Reset to preset**. Kontext keeps the scope. | | Stop blocking but keep observing | Click **Stop enforcing**. Kontext keeps a copy in Observing. | | Remove it | Click **Delete** and confirm. For an enforced policy, the dialog shows how many calls it blocked in the window. | Kontext marks a rule **Modified** when it differs from the catalogue preset. **Narrowed** means the observing copy covers fewer agents or endpoints than the enforced copy. **Removal** means the observing set omits an enforced policy. A warning appears under the title when a rule names a tool that endpoints do not report.