intutic_policy Cloud

An enforcement policy, managed through /api/v1/policies: what the proxy does when an agent calls a matching tool. Every change records a new version in the policy's audit history; destroying one soft-deletes it and keeps that history. Needs an OWNER or ADMIN key.

Example Usage

resource "intutic_policy" "no_force_push" {
  name                = "No force push"
  description         = "Agents may not rewrite shared history."
  target_tool_pattern = "Bash"
  enforcement_action  = "KILL"
  risk_category       = "DESTRUCTIVE"
  priority            = 10
  conditions          = jsonencode({ argContains = ["push --force"] })
}

Schema

Required

• enforcement_action (String) One of BYPASS, ENHANCE, HIJACK, REASK, KILL.
• name (String)
• target_tool_pattern (String) Tool name or glob the policy applies to; * matches all. Letters, digits and _ - . : / * only, for example Bash or mcp__github__*.

Optional

• conditions (String) Extra match conditions as a JSON object, for example jsonencode({ ... }).
• description (String)
• intervention_mode (String) What the agent is told when a call is refused; the active policy with the lowest priority sets it for the whole workspace. TRANSPARENT (default): the refusal names the rule and its reason. OPAQUE: the same calls are refused with the same refusal codes, but the agent is told only "Blocked by workspace policy. Ask a workspace admin if you need this action."; audit records keep the rule. SILENT_LOG: the local hook gates let a call a workspace rule would block run and report it as tool_would_block; built-in protections, SSO group rules and the MCP server registry still refuse, and the hosted hook gate and the proxies enforce as usual.
• is_active (Boolean) Whether the policy is enforced. Defaults to true.
• priority (Number) 0–10000; the lowest number wins. Defaults to 100.
• risk_category (String) One of NONE (default), DESTRUCTIVE, CREDENTIAL_ACCESS.

Read-Only

• current_version (Number) The policy's version number; each change adds one.
• id (String) The policy id (pol_…).

Import

# Import by policy id.
terraform import intutic_policy.no_force_push pol_0123456789abcdef