Set an approval policy once and apply it across every agent you run, instead of repeating the same gate configuration in every agent's config file. This guide covers creating, assigning, and managing policies at the workspace level.

Why use policies instead of per-agent gates

If you have five agents that all need to gate refunds over $100, defining that gate five separate times means five places to update if the threshold changes. A policy defines the rule once, in one place, and can be assigned to any number of agents.

Creating a policy

sublayr policies create \
  --name refund-policy \
  --action refund \
  --condition "amount > 100" \
  --approver finance-team

sublayr policies create \
  --name refund-policy \
  --action refund \
  --condition "amount > 100" \
  --approver finance-team

sublayr policies create \
  --name refund-policy \
  --action refund \
  --condition "amount > 100" \
  --approver finance-team

This creates a reusable policy named refund-policy that any agent can be assigned.

Assigning a policy to an agent

sublayr policies assign refund-policy --agent agt_4b81

sublayr policies assign refund-policy --agent agt_4b81

sublayr policies assign refund-policy --agent agt_4b81

An agent can have multiple policies assigned, and policies can be combined with agent-specific gates defined directly in that agent's config — both are enforced together.

Updating a policy

Because policies are centralized, updating one instantly updates enforcement across every agent it's assigned to:

sublayr policies update refund-policy --condition "amount > 150"

sublayr policies update refund-policy --condition "amount > 150"

sublayr policies update refund-policy --condition "amount > 150"

No redeployment of individual agents is required — the new condition takes effect on the next run.

Listing and auditing policies

See every policy in your workspace and which agents each is assigned to:

sublayr policies list

sublayr policies list

sublayr policies list

sublayr policies agents refund-policy

sublayr policies agents refund-policy

sublayr policies agents refund-policy

This is useful for periodic compliance reviews — confirming that every agent handling financial actions, for example, has the appropriate policy assigned.

Policy precedence

If an agent has both a workspace-level policy and an agent-specific gate that overlap on the same action, the more restrictive condition applies. For example, if a policy gates refunds over $100 and an agent's own config gates refunds over $50, the $50 threshold is enforced for that agent.

Enterprise: org-wide default policies

On Enterprise plans, you can mark a policy as an org-wide default, which is automatically applied to every new agent created in the workspace without requiring manual assignment — useful for baseline compliance requirements like data-deletion approvals or spend gates that should apply universally.