---
title: "Creating Policies"
description: "How to create and configure policies: violation actions, budget controls, preprocess integrity. Code examples for CLI, REST API, and Python SDK."
canonical: https://www.norcaster.com/docs/policies
---
<!-- Generated at build time from the rendered page by portal/scripts/generate-llms.mjs. The page is the source of truth; edit it, not this file. -->

# Creating Policies

Runtime policies control what AI is allowed to do at runtime: what happens on violations, budget limits, and artifact integrity. Configure them per deployment via config or apply pre-built enforcement packs.

## Policy types

Policies live under `pipeline_lock.policies` in your deployment config.

### 1\. Violation actions

What happens when schema or feature contract validation fails.

- `on_violation` — `block` | `allow_with_warning`
- `http_status` — Status code when blocked (default 400)
- `response_body` — `minimal` | `full`
- `include_violation_context` — Include violation details in response
- `emit_event` — Log to enforcement audit

### 2\. Budget policies

Request rate, compute limits, retry cost ceiling. Enforced before execution.

- `request_rate_per_minute` — Max requests per minute per user/deployment
- `max_compute_per_request_seconds` — Max compute seconds per request
- `retry_cost_multiplier_ceiling` — Max amplification from retries

### 3\. Preprocess integrity

Verify artifact checksums at worker boot (e.g. sklearn pipelines, tokenizers).

- `enabled` — Turn on integrity checks
- `fail_on_mismatch` — Fail deployment if checksum mismatch
- `artifacts` — Array of {name, type, sha256}

## Runtime decisions

Policies are evaluated at request time. They can block execution, allow with warning, redact sensitive text before provider inference, or stop a request because a budget gate was exceeded.

### Allow

The request passes policy and can continue to model, tool, or retrieval execution.

### Block

The request stops before inference and records an enforcement event.

### Warn

The request continues, but Norcaster records the violation for audit and visibility.

### Redact

Sensitive substrings are replaced before downstream model or tool calls.

## Enforcement packs

Pre-built policy presets. Apply from the dashboard or API.

- **rag-default** — RAG: prompt + context, strict schema, block on violation
- **agent-runtime** — Agent/tool-calling: messages, tools, warn mode
- **high-risk** — Maximum strictness, block, preprocess integrity
- **student-privacy** — Block or flag when student PII (name+ID, personnummer, email) is detected. [Learn more →](https://www.norcaster.com/docs/student-privacy)
- **enterprise-baseline** — Secrets-shaped patterns, PAN/IBAN, national IDs, then direct/weak PII handling
- **gdpr-data-protection** — Personal-data handling controls with redact/block/flag actioning and trace events
- **finance-pack** — Finance-sensitive prompt controls (PAN/identifier checks + finance-context warnings)
- **healthcare-pack** — Privacy-sensitive healthcare prompt controls (identifier handling + healthcare-context warnings)
- **cost-sensitive** — Budget policies: rate limit, compute limit, retry ceiling

## Contextual policy packs

Packs that detect and act on content (PII, student identifiers) rather than schema or contract. Run before the model. Audit events include `contextual` with detection types and reason codes.

### Student Privacy

**Dashboard → Deployments → \[deployment\] → Policies** tab → Enforcement packs → Student Privacy → Apply. Then use **Try it** with a prompt containing student name and ID to see a block.

## Code examples

Create policies via CLI, REST API, or Python SDK.

### CLI — deploy with policy config

Pass `-c` or `--config` with pipeline\_lock JSON.

```
norcaster deploy my-model -c '{
  "pipeline_lock": {
    "contract_version": "1.0",
    "mode": "enforce",
    "schema": {
      "strict": true,
      "input_schema": {
        "type": "object",
        "required": ["prompt"],
        "properties": { "prompt": { "type": "string" } },
        "additionalProperties": false
      }
    },
    "policies": {
      "actions": {
        "on_violation": "block",
        "http_status": 400,
        "include_violation_context": true
      }
    }
  }
}'
```

### CLI — deploy with budget policies

Add budget under `policies.budget`.

```
norcaster deploy my-model -c '{
  "pipeline_lock": {
    "contract_version": "1.0",
    "mode": "enforce",
    "schema": { "strict": true, "input_schema": { "type": "object", "properties": { "prompt": { "type": "string" } }, "required": ["prompt"], "additionalProperties": false } },
    "policies": {
      "actions": { "on_violation": "block" },
      "budget": {
        "request_rate_per_minute": 60,
        "max_compute_per_request_seconds": 120,
        "retry_cost_multiplier_ceiling": 2.0
      }
    }
  }
}'
```

### REST API — deploy with config

```
curl -X POST https://api.norcaster.com//deploy \
  -H "X-API-Key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "model_id": "my-model",
    "config": {
      "pipeline_lock": {
        "contract_version": "1.0",
        "mode": "enforce",
        "schema": {
          "strict": true,
          "input_schema": {
            "type": "object",
            "required": ["prompt"],
            "properties": { "prompt": { "type": "string" } },
            "additionalProperties": false
          }
        },
        "policies": {
          "actions": { "on_violation": "block" }
        }
      }
    }
  }'
```

### Python SDK — deploy with policy config

```
from norcaster import NorcasterClient

client = NorcasterClient(api_key="YOUR_API_KEY")

config = {
    "pipeline_lock": {
        "contract_version": "1.0",
        "mode": "enforce",
        "schema": {
            "strict": True,
            "input_schema": {
                "type": "object",
                "required": ["prompt"],
                "properties": {"prompt": {"type": "string"}},
                "additionalProperties": False,
            },
        },
        "policies": {
            "actions": {
                "on_violation": "block",
                "http_status": 400,
                "include_violation_context": True,
            },
        },
    },
}

deployment = client.deploy("my-model", config=config)
print(deployment.deployment_id)
```

### Apply enforcement pack via API

Replace deployment config with a preset pack.

```
curl -X POST https://api.norcaster.com//deployments/DEPLOYMENT_ID/apply-pack \
  -H "X-API-Key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"pack_id": "cost-sensitive"}'
```

Pack IDs: `rag-default`, `agent-runtime`, `high-risk`, `student-privacy`, `enterprise-baseline`, `gdpr-data-protection`, `finance-pack`, `healthcare-pack`, `cost-sensitive`

## Common questions

### What happens when a policy blocks?

Norcaster stops the request before inference, returns the configured response, and records an enforcement event so the decision is auditable.

### How do budget gates relate to billing?

Budget gates are runtime controls that prevent runaway usage. Billing still depends on your Norcaster plan and the external providers or infrastructure you use.