Enforcing a policy
Policy directives are signals — here's how to actually act on them.
Every scan already carries the org's Policy Studio verdict
in result.policy — a matched rule's directives
("block", "disable_tools", ...) and matchedRuleIds. Activating a
built-in template or a custom rule in the dashboard's Policy Studio changes
what that field contains on every future scan. It does not, by itself,
change what happens to the request.
Tawa never blocks anything on its own. Every scan returns a verdict,
including result.policy — but your code decides what happens next.
Until your integration checks that field and acts on it, nothing about
your traffic changes.
Raw SDK
Check result.policy.directives yourself after any
analyze()/scanContext()/scanChunk()/scanToolCall()/scanToolOutput()
call, the same way you'd check result.action:
const result = await tawa.analyze(userInput);
if (result.policy?.directives.includes("block")) {
throw new Error("Blocked by policy");
}Vercel AI SDK
Set TawaMiddlewareOptions.policy and tawaMiddleware/tawa() do this for
you — no manual check needed. "org-active" uses whatever's active in
Policy Studio; a built-in template id additionally layers that template's
rules on top. Off by default, so existing integrations are unaffected. Full
option reference: Vercel AI SDK integration.
const model = tawa(openai("gpt-5"), tawaClient, { policy: "org-active" });