# Policy Center Overview

The Policy Center serves as SailPoint's centralized policy administration point. It is the single place for the authoring, management, versioning, and deployment of fine-grained access and security policies across your organization. Policies are composed of information that includes the policy's purpose, ownership, and behavior, as defined by specific rules you put in place. Policies continuously monitor, evaluate, and enforce these defined business and security rules against each identity to detect and prevent compliance violations.

The Agentic Fabric Policy Center supports [Gateway Access](#gateway-access), [Endpoint Agent AuthZ](#endpoint-agent-authz), and [Prompt Security](#prompt-security) policies. Each policy type has its own section in the left navigation.

## Policy Evaluation

Every policy type follows the same evaluation flow. What differs per type is the input, which criteria attributes exist, what a match means, and how multiple matches are combined. The following is true across all types of policies:

- A disabled policy is never evaluated. If you want to include the policy, it must be in an Enabled state.
- Context includes both input data and real-time context, such as risk or other data retrieved from the Policy Information Point.
- Each policy's criteria are an AND/OR of groups, and each group is an AND/OR of items. A policy matches when the criteria test True. Some policy types have an option available to enforce case sensitivity. String comparisons are case-insensitive unless the author chooses to opt into case sensitivity on an item.
- Each policy evaluation records which configuration was used, for audit purposes.
- Each policy type has an [aggregator](#aggregators) that combines matching policies into one answer.
- Evaluation results are audited and include a summary of the outcome.

## Aggregators

| Policy Type | Aggregator | Combination rule |
| --- | --- | --- |
| Gateway Access | `any-match` | Any match is Allowed; no matches are Denied |
| Endpoint Agent AuthZ | `any-deny` | Any match is Denied; no matches are Allowed |

### Gateway Access

A Gateway Access policy is a security control rule enforced at a network gateway. It acts in real time to filter and manage incoming and outgoing requests and data for your environment before access is granted. For more information, refer to [Managing Gateway Access Policies](saf_gateway_access.md).

### Endpoint Agent AuthZ

An Endpoint Agent AuthZ policy is a set of runtime security rules that controls what an autonomous AI agent or software workload is allowed to access. It acts in real time to filter and manage incoming and outgoing requests and data for your environment before access is granted. For more information, refer to [Managing Endpoint Agent AuthZ Policies](saf_endpoint_agent_authz.md).

### Prompt Security

A Prompt Security policy scans your AI prompts on-device and enforces your policies before they are sent. Based on your settings, it can redact sensitive data or log it for audits. This protection covers both browser extensions and plugins, with all reports displayed in the Agentic Fabric console. For more information, refer to [Managing Prompt Security Policies](saf_prompt_security.md).

Policy Center Overview

The Policy Center serves as SailPoint's centralized policy administration point. It is the single place for the authoring, management, versioning, and deployment of fine-grained access and security policies across your organization. Policies are composed of information that includes the policy's purpose, ownership, and behavior, as defined by specific rules you put in place. Policies continuously monitor, evaluate, and enforce these defined business and security rules against each identity to detect and prevent compliance violations.

The Agentic Fabric Policy Center supports Gateway Access, Endpoint Agent AuthZ, and Prompt Security policies. Each policy type has its own section in the left navigation.

Policy Evaluation

Every policy type follows the same evaluation flow. What differs per type is the input, which criteria attributes exist, what a match means, and how multiple matches are combined. The following is true across all types of policies:

A disabled policy is never evaluated. If you want to include the policy, it must be in an Enabled state.
Context includes both input data and real-time context, such as risk or other data retrieved from the Policy Information Point.
Each policy's criteria are an AND/OR of groups, and each group is an AND/OR of items. A policy matches when the criteria test True. Some policy types have an option available to enforce case sensitivity. String comparisons are case-insensitive unless the author chooses to opt into case sensitivity on an item.
Each policy evaluation records which configuration was used, for audit purposes.
Each policy type has an aggregator that combines matching policies into one answer.
Evaluation results are audited and include a summary of the outcome.

Aggregators

Policy Type	Aggregator	Combination rule
Gateway Access	`any-match`	Any match is Allowed; no matches are Denied
Endpoint Agent AuthZ	`any-deny`	Any match is Denied; no matches are Allowed

Gateway Access

A Gateway Access policy is a security control rule enforced at a network gateway. It acts in real time to filter and manage incoming and outgoing requests and data for your environment before access is granted. For more information, refer to Managing Gateway Access Policies.

Endpoint Agent AuthZ

An Endpoint Agent AuthZ policy is a set of runtime security rules that controls what an autonomous AI agent or software workload is allowed to access. It acts in real time to filter and manage incoming and outgoing requests and data for your environment before access is granted. For more information, refer to Managing Endpoint Agent AuthZ Policies.

Prompt Security

A Prompt Security policy scans your AI prompts on-device and enforces your policies before they are sent. Based on your settings, it can redact sensitive data or log it for audits. This protection covers both browser extensions and plugins, with all reports displayed in the Agentic Fabric console. For more information, refer to Managing Prompt Security Policies.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.