Policies

An organization can keep several named policies, such as Standard for everyone and Deal teams for people who handle live mandates. Every request records the policy and version that were in force when it was checked. Administrators create and edit policies under Policies; viewers can read them. The alpha console cannot create viewer accounts yet, so every account is an administrator.

New organizations start with one policy, Standard, which is the default. It has five rules, credentials, email addresses, payment card numbers, IBANs and national ID numbers, all set to Let employee choose. It blocks image files, checks the text of documents with images, turns AI app discovery on and blocks sending when the policy is unavailable.

Which policy a browser uses

Each enrolled browser runs exactly one policy, chosen in this order:

1. The policy set on the device itself, if an administrator chose one in its details under Devices.
2. Otherwise, the policy of the device’s team.
3. Otherwise, the default policy.

A team without its own policy follows the default. Policies shows where each policy applies and how many of its browsers already run its current version. To change a team’s policy, open the team under Devices, or use Assign teams on the policy.

To create a policy, choose New policy, give it a name and start from the starter rules or a copy of an existing policy. Manage on a policy edits its name and description, duplicates it, makes it the default or deletes it. The default policy can’t be deleted. When you delete a policy, its teams and devices fall back to their team’s policy or the default, and past requests keep the rules they were checked against.

Rule categories

Category	What it matches
Credentials & secrets	API keys, access tokens and private keys in the formats below
Email addresses	Email addresses written in ASCII characters
Payment card numbers	Credit and debit card numbers from known issuers with a valid checksum
IBANs	International bank account numbers with a valid checksum
National ID numbers	Turkish national ID numbers (TCKN) with a valid checksum
Confidential terms	Names, codenames and patterns you list

Policies created in the console include the five built-in categories, and the editor always lists them. Set one to Off to stop checking for it, for example when numbers in your data keep passing the card or ID checks, or to Monitor only to record its matches without interrupting employees. Confidential terms are added with Add confidential terms and can be removed. A policy keeps at least one rule on, so the editor won’t turn off or remove the last one.

Credentials & secrets recognizes these formats:

• GitHub personal access tokens (ghp_, github_pat_)
• OpenAI API keys (sk-, sk-proj-)
• AWS access key IDs (AKIA)
• Google API keys (AIza)
• Slack tokens (xoxb-, xoxp-, xoxa-, xoxe-, xoxo-, xoxr-, xoxs-, xapp-)
• Stripe secret and restricted keys (sk_live_, sk_test_, rk_live_, rk_test_)
• JSON Web Tokens (eyJ…)
• Private key blocks, from -----BEGIN … PRIVATE KEY----- to the matching END line

Credential detection is not exhaustive. A token must stand on its own; text joined to it by letters, digits, underscores or hyphens is not matched. A private key block is masked as a whole. Public keys, certificates and Stripe publishable keys (pk_) are not matched.

A payment card number is 13 to 19 digits, written together or in the groups printed on cards with single spaces or hyphens, that starts with a known issuer’s prefix at that issuer’s length and passes the Luhn check. An IBAN is uppercase, written together or in groups of four, with a country’s registered length and a valid check. A national ID number is an 11-digit Turkish identity number with both check digits. These are format checks: shim does not ask a bank or registry whether a number exists, and some order numbers, account numbers or long IDs can pass them. Rates on synthetic text are in Coverage and limits.

Confidential terms

Choose Add confidential terms to create the rule, then enter one term or phrase per line. Each term is up to 128 characters. The rule holds up to 100 terms, and up to 16 of them can use wildcards. Terms ignore letter case, and every character matches itself except three wildcards:

Wildcard	Matches	Example
*	Up to 64 characters other than spaces	Falcon-* matches Falcon-7 and Falcon-Prod
?	Any one character other than a space	Gr?y matches Grey and Gray
#	Any one digit	INV-#### matches INV-2041

Put * at the start or end of a word: *@acme.example matches any address at that domain, and Project * budget matches one word between the two. A term that starts with a wildcard and has a * matches only from the start of a word, so #* units matches 5 units but not x5 units. A term can have up to four *, never two in a row, and needs at least two characters besides spaces and wildcards. The editor explains why a term is rejected. There is no way to match *, ? or # themselves, so a term such as C# can’t be listed.

Actions

Each rule has one action. When several rules match the same prompt, the strictest action applies.

Action	What happens
Monitor only	The prompt is sent without a dialog, and the request is recorded with the original prompt
Let employee choose	The review opens with Edit or mask, Send once and Cancel
Require masking	The review opens without Send once. The employee edits or masks the draft, or cancels. Nothing is replaced automatically
Enforce block	The review opens without Send once and with no override. The original is never sent; the employee can edit or mask the draft, or cancel

What employees see

A matched prompt that is not monitor-only opens a review dialog over the composer. Its title says what the policy requires: Review before sending, Masking required or Blocked by your organization. The dialog counts what was found by category and tells the employee what administrators can review. Prompt text is deleted 90 days after it is captured.

• Edit or mask shows the draft beside a preview with each distinct match replaced by a numbered key such as [REDACTED_1]; repeats of the same value share a number. Send edited prompt sends the employee’s revision. Mask and send masks the current draft and sends it.
• Send once is offered only for Let employee choose. It asks for confirmation, with an optional explanation of up to 500 characters; the dialog notes “Administrators can read this; avoid sensitive data.” Only administrators can read the explanation, beside the request in the inspector. The confirming button names the application, such as Send to ChatGPT.
• Cancel or Escape closes the dialog and keeps the draft.

Edited and masked drafts are checked again against the current rules before they are applied. Text that still breaks a rule stays in the same panel with an inline warning, so the employee can revise it or mask it. Only Send once can accept a warning, and its approval covers that one send. Repeating the prompt or moving to another chat starts a fresh review.

Images in files

shim checks the text in attached files but can’t read text inside images. Images in files decides what happens to them.

Setting	Options
Image files: photos, screenshots and scans attached on their own	Block, the default, keeps them out because they can’t be checked. Allow attaches them without inspection
Documents with images: PDFs, Word, Excel and PowerPoint files that contain pictures	Check text, the default, checks the document’s text and leaves its images uninspected, so logos and charts stay usable; the employee sees “Text checked · images not inspected”. Block keeps out any document with an embedded image

An SVG file counts as an image, and allowing image files still checks its text. A PDF page that is only an image, such as a scan, has no text to check, so the file is kept out under either setting.

AI app discovery

AI app discovery decides whether the policy’s browsers note which listed AI apps they open, for the console’s AI apps page. It is On in the starter rules.

Setting	Effect
On	Each browser records the app and the day, never the address, the page or what was typed, and nothing from incognito windows
Off	The browser records no AI apps and drops any it has not sent yet. The console ignores any it still receives

A browser follows the setting of the policy it runs, so a team or a single device can have discovery off while the rest of the organization keeps it on. AI apps leaves those browsers out of its counts and says how many. Turning discovery back on starts recording from the next AI app the browser opens; apps already open are picked up at the following sync, about a minute later. The publish review lists turning it off as looser and turning it on as stricter. Tell employees which setting applies to them; see Tell employees.

Offline and expired policies

Browsers cache the policy for 24 hours after each sync and keep enforcing it while they cannot reach the console. Once the cached policy expires, rules set to Enforce block or Require masking still apply, and the setting under When the policy is unavailable decides what happens to every other prompt:

Setting	Effect after expiry
Let employee choose	Every other prompt in a recognized composer opens the review, matched or not, saying the policy expired
Enforce block	The default. Every prompt in a recognized composer is blocked with “Your policy expired. Sync shim to resume sending.”

The browser returns to normal on its next successful sync. A browser with no policy at all, because it was never enrolled, was reset or had its access revoked, cannot send from a recognized composer: it shows shim setup required and asks the employee to enroll.

Try a policy

Try this policy checks sample text against the rules on screen, including unsaved changes, with the same detector the extension uses. It shows what the employee would see, such as Review before sending or Blocked by your organization, and highlights each match. The text stays in the page; it is not sent or saved.

Publishing changes

Changes stay a draft until you choose Review and publish. The review lists every change, marks each one stricter or looser and takes an optional note of up to 200 characters, such as why the change was made. Publish creates the next version. Browsers pick it up on their next sync, which runs every minute, and open AI tabs refresh their copy every 15 seconds. The policy page shows how many active browsers already report the current version.

If another administrator published the same policy while you were editing, publishing stops so you don’t overwrite their change. Refresh, then apply your change to the new version.

History

History lists every version of a policy, newest first, with who published it, when, their note and what changed from the version before. Versions are never edited or deleted. Restore loads an older version into the editor as a draft; publishing it creates a new version noted as restored, so the history stays complete.