ArmorIQ LogoArmorIQ Docs
Core Methodsget_intent_token()

Policy Specification

Define authorization policies for intent tokens.

Policy Specification

Policies can be defined programmatically (in the SDK) or visually (ArmorIQ Canvas).

Policy Structure

{
    "allow": list[str],            # Allowed actions (glob patterns, e.g., "analytics-mcp/*")
    "deny": list[str],             # Denied actions (glob patterns, e.g., "data-mcp/delete_*")
    "allowed_tools": list[str],    # Whitelisted tool names (optional)
    "rate_limit": int,             # Requests per hour (optional)
    "ip_whitelist": list[str],     # Allowed IPs/CIDR ranges (optional)
    "time_restrictions": {         # Time-based access (optional)
        "allowed_hours": list[int],    # 0-23 (e.g., [9, 10, 11, ..., 17] for 9 AM - 5 PM)
        "allowed_days": list[str]      # ["Monday", "Tuesday", ...]
    },
    "priority": int                # Policy priority 0-100 (higher = more important)
}

Method 1: Programmatic (SDK)

policy = {
    "allow": ["analytics-mcp/*", "data-mcp/fetch_*"],
    "deny": ["data-mcp/delete_*"],
    "allowed_tools": ["read_file", "analyze", "aggregate"],
    "rate_limit": 100,
    "ip_whitelist": ["10.0.0.0/8"],
    "time_restrictions": {
        "allowed_hours": [9, 10, 11, 12, 13, 14, 15, 16, 17],
        "allowed_days": ["Monday", "Tuesday", "Wednesday", "Thursday", "Friday"]
    }
}

token = client.get_intent_token(
    plan_capture=plan,
    policy=policy,
    validity_seconds=3600
)

Method 2: Visual Policy Builder (ArmorIQ Canvas)

Use the drag-and-drop interface at https://platform.armoriq.ai/dashboard/policies:

  1. Click "Canvas" button to open visual builder
  2. Drag users, MCPs, and agents onto canvas
  3. Connect entities with edges (connections)
  4. Click edge to configure permissions visually
  5. Use "Browse Tools" to select allowed tools from MCP
  6. Set IP restrictions, time windows, rate limits
  7. Save policy with name and priority

Policies you author in the dashboard do not need to be passed to the SDK. They are stored against your organization and evaluated by the platform during enforcement, so a plain get_intent_token call is already subject to them:

token = client.get_intent_token(plan_capture=plan, validity_seconds=3600)

If the plan violates a stored policy you get a PolicyBlockedException, or a PolicyHoldException when it requires approval. See Error Handling.

There is no policy_id parameter. get_intent_token accepts plan_capture, policy and validity_seconds only. The policy argument is an inline dict that further constrains this one token; it is not a way to load a stored policy by id, and the stored-policy REST shape is not compatible with it.

To inspect or edit stored policies, use the dashboard or the platform API rather than fetching them into the SDK:

Policy Encoding

The policy is automatically encoded into the CSRG token JWT payload and cryptographically verified during execution. The proxy enforces policy rules before routing requests to MCPs.

get_intent_token()

Previous Page

invoke()

Next Page

On this page

Policy SpecificationPolicy StructureMethod 1: Programmatic (SDK)Method 2: Visual Policy Builder (ArmorIQ Canvas)Policy Encoding