Policies

Overview

Policies define how Checkpoint handles detected AI agents and bots. When a request is classified by the Gateway or Middleware, the policy engine evaluates the detection result and determines the response action.

Policy Evaluation Order

Policies are evaluated in priority order. The first matching rule wins:

1. Allow list     (highest priority)
2. Deny list
3. Path-based rules
4. Confidence threshold
5. Default action  (lowest priority)

Available Actions

Policy Configuration

Via the Dashboard

1. Navigate to Project Settings → Enforce
2. Click Configure Policy on your Gateway or Middleware
3. Set rules using the policy editor
4. Save and apply

JSON Configuration

{
  "defaultAction": "allow",
  "blockThreshold": 80,
  "allowList": ["Googlebot", "Bingbot", "Yandex"],
  "denyList": ["malicious-bot", "scraper-ua"],
  "pathRules": [
    {
      "pattern": "/api/*",
      "action": "block",
      "minConfidence": 70
    },
    {
      "pattern": "/public/*",
      "action": "log"
    },
    {
      "pattern": "/checkout/*",
      "action": "block",
      "minConfidence": 50
    }
  ]
}

Allow List

The allow list has the highest priority. User agents matching the allow list are always allowed through, regardless of detection results.

Common entries:

Deny List

The deny list blocks specific user agents or identifiers. Deny list entries are checked after the allow list but before other rules.

You can also manage deny list entries from the Deny List tab in the project dashboard, which supports blocking by:

• User agent string
• IP address or CIDR range
• Browser/device fingerprint

Path-Based Rules

Apply different policies to different URL paths:

{
  "pathRules": [
    {
      "pattern": "/api/admin/*",
      "action": "block",
      "minConfidence": 50
    },
    {
      "pattern": "/api/public/*",
      "action": "log"
    },
    {
      "pattern": "/checkout/*",
      "action": "redirect",
      "redirectUrl": "/bot-detected",
      "minConfidence": 70
    }
  ]
}

Rule Fields

Confidence Threshold

The global blockThreshold sets the minimum confidence score required to enforce the default blocking action:

{
  "blockThreshold": 80,
  "defaultAction": "block"
}

With this configuration, only detections with confidence ≥ 80 are blocked. Lower-confidence detections are logged but allowed through.

Choosing a Threshold

Default Action

The defaultAction applies when no other rule matches:

• "allow" — Allow all unmatched traffic (recommended starting point)
• "block" — Block all detected agents above the threshold
• "log" — Log detections without taking action

MCP-I Integration

Policies can integrate with Govern features. Agents that present valid MCP-I proofs can be treated differently:

• Agents with valid delegations can be allow-listed automatically
• Agents without proofs follow standard policy evaluation
• This enables a "known agents welcome, unknown agents blocked" approach

Testing Policies

1. Set your policy to "log" mode initially
2. Monitor detections in the dashboard
3. Review classifications and confidence scores
4. Adjust thresholds and rules based on real traffic
5. Switch to "block" or "redirect" when confident

Next Steps

• Detection in Enforce Mode — Understand detection signals
• Gateway Enforcement — DNS-based policy enforcement
• Middleware Enforcement — Code-based policy enforcement
• Monitoring — Track policy effectiveness