Access Policies

Token Vault includes an Attribute-Based Access Control (ABAC) policy system. Policies let you define fine-grained rules that are evaluated on every credential request - agent access, MCP proxy injection, or direct token retrieval.

How Policies Work

Rule Types

Creating a Policy

1. Go to the Policies tab.
2. Click Create Policy.
3. Give it a name and optional description.
4. Add one or more rules using the rule editor.
5. Save the policy.
6. Attach it to the entities you want to protect.

The create dialog lets you name your policy, add rules, and configure each rule's parameters:

Managing Policies

The Policies page shows all your policies with their rule counts and action buttons for editing, attaching, and deleting:

Attaching Policies

Policies are attached to entities - agents, MCP proxies, or individual tokens. One policy can be attached to many entities, and one entity can have many policies.

To attach a policy:

1. Open the Policies tab in the dashboard.
2. Click the attach icon on the policy you want to use.
3. Select the entity type (agent, proxy, or token) and pick the entity.
4. The policy takes effect immediately - the next credential request will be evaluated against it.

To detach, open the same dialog and remove the attachment.

Example: Business Hours + Office IP

Create a policy with two rules:

Attach it to your GitHub agent. Now that agent can only retrieve GitHub credentials during business hours from the office network. A request at 22:00 or from a home IP is denied with:

403 POLICY_DENIED
Policy: "Business Hours"
Rule: time_window
Reason: "Current time 22:15 is outside allowed window 09:00-17:00"

Example: Rate-Limited, Geo-Fenced Proxy

Create a policy with two rules:

Attach it to an MCP proxy. Requests from outside the allowed countries are refused, and if the proxy exceeds 50 requests in 5 minutes it is temporarily blocked regardless of origin.

What Happens When Denied

When any rule fails, Token Vault returns:

{
  "error": "POLICY_DENIED",
  "policyName": "Business Hours",
  "ruleType": "time_window",
  "reason": "Current time 22:15 is outside allowed window 09:00-17:00"
}

The response always includes the policy name, rule type, and a human-readable reason so you can diagnose why access was blocked. Denied requests are logged to your audit trail.