> ## Documentation Index
> Fetch the complete documentation index at: https://docs.airmux.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Create a workspace policy

> Create a self-contained policy and verify it from the CLI.

A policy contains its target and every rule it enforces. This example limits every request in the active workspace to 1,024 output tokens.

<Steps>
  <Step title="Create the policy configuration">
    Save this as `output-limit-policy.json`:

    ```json theme={null}
    {
      "name": "Production output limit",
      "enabled": true,
      "definition": {
        "target": {"kind": "workspace"},
        "rules": [
          {
            "match": {"kind": "all_requests"},
            "action": {"kind": "request_limits", "max_output_tokens": 1024}
          }
        ]
      }
    }
    ```
  </Step>

  <Step title="Create and inspect the policy">
    ```bash theme={null}
    airmux policies create output-limit-policy.json
    airmux policies list
    ```
  </Step>

  <Step title="Verify behavior">
    With the policy active, a Chat Completions request with `max_completion_tokens` greater than `1024` returns
    `403 policy_denied`. A request that omits the field sends `1024` upstream and reports a `defaulted` adjustment with
    `source: policy`. If several matching policies set limits, the tightest ceiling applies.
  </Step>
</Steps>

Use `{"kind": "workspace"}` for every current and future credential, including playground sessions. To restrict a principal
across their credentials in this workspace, replace the target with `{"kind": "selected_users", "user_ids": ["USER_UUID"]}`.
Use `{"kind": "selected_keys", "key_ids": ["KEY_ID"]}` for specific credentials. The webapp's **Applies to** selector
exposes the same three targets, including service accounts in the user picker. Key inspection lists all applicable policies.

See [workspace policies](/docs/policies) for every match and action type.