> For the complete documentation index, see [llms.txt](https://docs.ox.security/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.ox.security/ox-policies/policies.md).
# About Policies
Policies help organizations control risk across the supply chain and enforce security standards. When a policy detects a violation, OX creates an issue and links it to the relevant application, repository, or artifact.
## **Policy categories**
OX policies are organized into five categories based on the security areas they address. On the Policies page, select a category to view its policy groups and configure the applicable policies.
| Policy category | Description |
| --------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Code Security | Identifies security risks in source code, repositories, open-source dependencies, software bills of materials (SBOMs), infrastructure as code, CI/CD pipelines, and API configurations. |
| AI Security | Detects risky operations performed by AI coding tools and external attacks targeting AI agents and their workflows. |
| Agentic Pentest | Identifies exploitable vulnerabilities confirmed by OX Agentic Pentest through controlled testing of running web applications. |
| Cloud Security | Identifies security risks in cloud configurations, workloads, serverless applications, runtime environments, container images, and artifacts. |
| External | Includes security findings imported from external sources or manually uploaded issue files. |
## **Policy permissions**
Role
View
Edit
Admin
:check:
:check:
Policy Manager
:check:
:check:
Dev Manager / Security Champion
:check:
:check:
Developer
:check:
:check:
Read only
:check:
:x:
## **Edit policy settings**
OX determines the policy severity by default, but you can change the severity or enable / disable the policy if your organization requires it.
**To change policy severity:**
1. Select the severity from the dropdown.
2. To save the change in the current profile, click **SAVE** in the page header.
**To enable or disable a policy:**
1. Use the ON / OFF toggle.
2. To save the change in the current profile, click **SAVE** in the page header.
{% hint style="info" %}
If you want to save the changes **and** create a separate profile, see the section [Create or edit policy profiles](#create-or-edit-policy-profiles).
{% endhint %}
## **Filter policy issues**
1. Open the Active Issues page.
2. Use the **Policy** filter to refine the list by category or specific policy.
## **Create or edit policy profiles**
The Policies page has a default profile. You can create multiple profiles anḍ decide which profile you want to be the active profile. OX backs up the active profile only.
**To save changes to the current profile:**
1. Change either the severity and/or ON/OFF status on one or multiple policies.
2. From the page header, click **SAVE**.
**To create a new profile:**
* From the page header, click **SAVE AS**, name the profile, and choose whether to set it as the active profile.
**To change the active profile:**
1. From the page header, open the **Select Profile** dropdown and select the profile you want to make active.
2. Activate the checkbox **Set as active profile**. When you return to the Policies page, the new active profile displays.\
.png?alt=media)
**To view a non-active profile:**
* Select the profile from the Select Profile dropdown.
## Policy best practices
We recommend you:
* Review issues regularly to identify non-compliant artifacts.
* Enable only the policies your organization needs.
* Adjust the OX policy severity only if you believe that the default severity does not reflect your organization’s risk policy.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://docs.ox.security/ox-policies/policies.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
.png?alt=media)
