Setting Up Access Policies
Policies are the rules that decide what happens when your agent tries to take an action. Every time an agent attempts something — reading data, sending a message, updating a record — Gatekeeper checks that request against your policies before it's allowed to run.
The three possible outcomes
Every policy resolves to one of three outcomes:
- Allow — the action runs immediately, no interruption.
- Deny — the action is blocked outright, and the agent is told it isn't permitted.
- Require approval — the action pauses until a person manually approves or rejects it.
Creating a policy
- Go to Policies in your Gatekeeper dashboard.
- Choose the service the policy applies to (e.g. HubSpot, GitHub).
- Define the condition — this is the type of action you're writing a rule for (e.g. "any write action," "delete a contact," "create a new record").
- Choose the outcome: Allow, Deny, or Require approval.
- Save the policy. It takes effect immediately for all future actions matching that condition.
Starting simple
A reasonable starting policy set for most teams:
- Allow all read actions (looking up data, viewing records).
- Require approval for write actions (creating or updating records).
- Deny all delete actions, until you're confident in how your agent behaves.
You can loosen or tighten these over time as you build trust in what your agent does.
Policy precedence
If more than one policy could apply to the same action, the more specific rule takes precedence over a general one. For example, a specific "deny deletes in the Onboarding pipeline" rule will override a general "allow all writes" rule for that pipeline.