Skip to main content
A policy contains its target and every rule it enforces. This example limits every request in the active workspace to 1,024 output tokens.
1

Create the policy configuration

Save this as output-limit-policy.json:
2

Create and inspect the policy

3

Verify behavior

With the policy active, a Chat Completions request with max_completion_tokens greater than 1024 returns 403 policy_denied. A request that omits the field sends 1024 upstream and reports a defaulted adjustment with source: policy. If several matching policies set limits, the tightest ceiling applies.
Use {"kind": "workspace"} for every current and future credential, including playground sessions. To restrict a principal across their credentials in this workspace, replace the target with {"kind": "selected_users", "user_ids": ["USER_UUID"]}. Use {"kind": "selected_keys", "key_ids": ["KEY_ID"]} for specific credentials. The webapp’s Applies to selector exposes the same three targets, including service accounts in the user picker. Key inspection lists all applicable policies. See workspace policies for every match and action type.