# Managing Endpoint Agent AuthZ Policies

Org Admins, SAF Admins, and users with Endpoint Access Authorization Policy Management privileges can create Endpoint Agent AuthZ policies to govern access according to defined rules. For more information about permissions, refer to [User Levels](../common/users/index.md).

An Endpoint Agent AuthZ policy describes a set of criteria that, when they match an evaluation request, cause that request to be denied. Access requests are automatically allowed unless you create policies that restrict them. Once policies are established, the system evaluates incoming requests against your defined criteria to determine access. If at least one policy exists and the inputs match the criteria you set, the request will be denied. If the inputs do not match the policy criteria, the request will be allowed. Review the following table for evaluation logic:

| Policies Created | Do inputs match criteria? | Access Result |
| --- | --- | --- |
| No policies exist | N/A | Allowed |
| At least one policy exists | Yes (Matches criteria) | Denied |
| At least one policy exists | No (Does not match) | Allowed |

## Creating an Endpoint Agent AuthZ Policy

Create an Endpoint Agent AuthZ policy to define the details and criteria.

1. Go to **Agentic Fabric**, then select **Policy Center** from the left navigation.

You can also go to **Admin > Policy Center > Administration**, then select **Agentic** from the left navigation.

2. Select **Endpoint Agent Access AuthZ**.

3. Select **Create Policy**.

4. On the general details page, enter the **Name** of the policy.

5. Enter a **Description** of the policy.

6. Select an option for **Owner Type**.

7. Enter the name of the **Policy Owner** or select from the dropdown list.

8. Select **Next**.

9. On the match criteria page, use the **Between Groups** toggle to specify whether your criteria should be combined with an AND or an OR operator.

- AND - All criteria must be met.
    - OR - Any criteria may be met.

10. Use the **Within Group** toggle to specify whether your criteria should be combined with an AND or an OR operator.

- AND - All criteria must be met.
    - OR - Any criteria may be met.

11. Use the **Object Type** dropdown list to select which source the attribute should come from. The following options are available:

- **Identity** - The identity on whose behalf the tool call is made. Resolved from `userEmail` in the evaluate input.
    - **Agent** - The AI client attempting the call, provided in the input as `agentName`. For example, `claude-code`.
    - **Tool** - The specific MCP tool being invoked, provided in the input as `toolName`. For example, `create_repository`.
    - **Tool Family Category** - Represents the family that the tool belongs to.
    - **Tool Family MCP** - Holds the parameters required by the MCP tool family.
    - **Tool Family Terminal** - Holds the parameters required by the terminal tool family.
    - **Tool Family File** - Holds the parameters required by the file tool family.

12. Select an **Attribute** from the dropdown list. The available options are specific to the object type.

13. Select an **Operator** from the dropdown list to choose how to compare the value of the selected attribute with the value you enter. The available options are specific to the attribute, and can include the following:

- **Equals** - The attribute and value must match. Multiple values are compared as OR operations.
    - **Does Not Equal** - The attribute and value cannot match.
    - **Contains** - The specified value must exist somewhere within the attribute's value.
    - **Does Not Contain** - The specified value cannot exist somewhere within the attribute's value.
    - **Starts With** - The attribute must start with the specified value.
    - **Ends With** - The attribute must end with the specified value.
    - **Any of** - The attribute matches any of the supplied list of values.

14. Enter the **Value** of the attribute. The value field is specific to the object type and attribute. Depending on your selections, it might contain a dropdown list of available options or a free-text field. In free-text fields, select the Enter key to add the value.

15. Select **Add Criteria** to enter additional criteria.

Select the recycle bin if you want to delete the criteria.

16. If your requirements are more complex, needing both AND and OR relationships, select **Add Group** to add another group.

Policies are limited to:

- 5 groups
    - 10 criteria per group
    - 50 values per multi-value match criteria

Select **Delete Group** if you want to delete the group.

17. Select **Finish** to complete the policy creation. The policy is saved in a disabled state.

## Taking Action on an Endpoint Agent AuthZ Policy

Select the **Actions** menu <img src="../img/actions-menu.png" class="img-fluid" width=3%> to perform the policy actions.

- **View Details** - Displays the details of the policy.
- **Edit** - Allows the policy to be changed. The policy status must be disabled before it can be edited.
- **Duplicate** - Creates a copy of the policy with the general details and match criteria included. Copies of the policy are created as disabled by default.
- **Disable** - Changes the policy status to disabled. The policy will not be included in evaluation.
- **Enable** - Changes the policy status to enabled. The policy will be included in evaluation.
- **Delete** - Deletes the policy. The policy status must be disabled before it can be deleted.

## Editing an Endpoint Agent AuthZ Policy

Edit an Endpoint Agent AuthZ policy to change the details and criteria.

1. Go to **Agentic Fabric > Policy Center**.

You can also go to **Admin > Policy Center > Administration**, then select **Agentic** from the left navigation.

2. Select **Endpoint Agent AuthZ** from the left navigation.

3. Use the filter options to search for a policy by name, status, and owner. Select the column headings if you want to sort the results. Select the **Column Chooser** icon <img src="../img/columnchooser.png" class="img-fluid" width=3%> to remove a column from view.

4. View the **Status** of the policy you want to edit. The policy status must be disabled before it can be edited.

5. Select the **Actions** menu <img src="../img/actions-menu.png" class="img-fluid" width=3%> for the policy.

6. If the policy is enabled, select **Disable**, then select **Disable** again to confirm your selection. If the policy is already disabled, select **Edit**.

7. On the general details page, make the required edits.

8. Select **Save**.

9. Select **Match Criteria** from the left navigation, then make the required edits.

10. Select **Save**.

Managing Endpoint Agent AuthZ Policies

Org Admins, SAF Admins, and users with Endpoint Access Authorization Policy Management privileges can create Endpoint Agent AuthZ policies to govern access according to defined rules. For more information about permissions, refer to User Levels.

An Endpoint Agent AuthZ policy describes a set of criteria that, when they match an evaluation request, cause that request to be denied. Access requests are automatically allowed unless you create policies that restrict them. Once policies are established, the system evaluates incoming requests against your defined criteria to determine access. If at least one policy exists and the inputs match the criteria you set, the request will be denied. If the inputs do not match the policy criteria, the request will be allowed. Review the following table for evaluation logic:

Policies Created	Do inputs match criteria?	Access Result
No policies exist	N/A	Allowed
At least one policy exists	Yes (Matches criteria)	Denied
At least one policy exists	No (Does not match)	Allowed

Creating an Endpoint Agent AuthZ Policy

Create an Endpoint Agent AuthZ policy to define the details and criteria.

Go to Agentic Fabric, then select Policy Center from the left navigation.

You can also go to Admin > Policy Center > Administration, then select Agentic from the left navigation.
Select Endpoint Agent Access AuthZ.
Select Create Policy.
On the general details page, enter the Name of the policy.
Enter a Description of the policy.
Select an option for Owner Type.
Enter the name of the Policy Owner or select from the dropdown list.
Select Next.
On the match criteria page, use the Between Groups toggle to specify whether your criteria should be combined with an AND or an OR operator.
- AND - All criteria must be met.
- OR - Any criteria may be met.
Use the Within Group toggle to specify whether your criteria should be combined with an AND or an OR operator.
- AND - All criteria must be met.
- OR - Any criteria may be met.
Use the Object Type dropdown list to select which source the attribute should come from. The following options are available:
- Identity - The identity on whose behalf the tool call is made. Resolved from userEmail in the evaluate input.
- Agent - The AI client attempting the call, provided in the input as agentName. For example, claude-code.
- Tool - The specific MCP tool being invoked, provided in the input as toolName. For example, create_repository.
- Tool Family Category - Represents the family that the tool belongs to.
- Tool Family MCP - Holds the parameters required by the MCP tool family.
- Tool Family Terminal - Holds the parameters required by the terminal tool family.
- Tool Family File - Holds the parameters required by the file tool family.
Select an Attribute from the dropdown list. The available options are specific to the object type.
Select an Operator from the dropdown list to choose how to compare the value of the selected attribute with the value you enter. The available options are specific to the attribute, and can include the following:
- Equals - The attribute and value must match. Multiple values are compared as OR operations.
- Does Not Equal - The attribute and value cannot match.
- Contains - The specified value must exist somewhere within the attribute's value.
- Does Not Contain - The specified value cannot exist somewhere within the attribute's value.
- Starts With - The attribute must start with the specified value.
- Ends With - The attribute must end with the specified value.
- Any of - The attribute matches any of the supplied list of values.
Enter the Value of the attribute. The value field is specific to the object type and attribute. Depending on your selections, it might contain a dropdown list of available options or a free-text field. In free-text fields, select the Enter key to add the value.
Select Add Criteria to enter additional criteria.

Select the recycle bin if you want to delete the criteria.
If your requirements are more complex, needing both AND and OR relationships, select Add Group to add another group.

Policies are limited to:
- 5 groups
- 10 criteria per group
- 50 values per multi-value match criteria
Select Delete Group if you want to delete the group.
Select Finish to complete the policy creation. The policy is saved in a disabled state.

Taking Action on an Endpoint Agent AuthZ Policy

Select the Actions menu to perform the policy actions.

View Details - Displays the details of the policy.
Edit - Allows the policy to be changed. The policy status must be disabled before it can be edited.
Duplicate - Creates a copy of the policy with the general details and match criteria included. Copies of the policy are created as disabled by default.
Disable - Changes the policy status to disabled. The policy will not be included in evaluation.
Enable - Changes the policy status to enabled. The policy will be included in evaluation.
Delete - Deletes the policy. The policy status must be disabled before it can be deleted.

Editing an Endpoint Agent AuthZ Policy

Edit an Endpoint Agent AuthZ policy to change the details and criteria.

Go to Agentic Fabric > Policy Center.

You can also go to Admin > Policy Center > Administration, then select Agentic from the left navigation.
Select Endpoint Agent AuthZ from the left navigation.
Use the filter options to search for a policy by name, status, and owner. Select the column headings if you want to sort the results. Select the Column Chooser icon to remove a column from view.
View the Status of the policy you want to edit. The policy status must be disabled before it can be edited.
Select the Actions menu for the policy.
If the policy is enabled, select Disable, then select Disable again to confirm your selection. If the policy is already disabled, select Edit.
On the general details page, make the required edits.
Select Save.
Select Match Criteria from the left navigation, then make the required edits.
Select Save.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.