> ## Documentation Index
> Fetch the complete documentation index at: https://docs.danubeai.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Tool Access Policies

> Decide which members, teams and roles can call which services and tools

<Note>
  **Early access.** Policies can be created and are evaluated on every call, and every would-be denial is written to the [audit log](/organizations/audit-log). In the current release denials are recorded rather than blocked while enforcement is rolled out per organization. Contact us at [danubeai.com/contact-sales](https://danubeai.com/contact-sales) to turn enforcement on for your organization.
</Note>

A policy is one statement: a **subject** (the whole organization, a team, or a role) is **allowed** or **denied** a **service** or a single **tool**. Together, an organization's policies decide what each member's agents can call.

## How evaluation works

* **No policies means ungoverned.** Every member keeps full access to the organization's tools.
* **The first policy switches the organization to deny-by-default.** From then on, a member can only use what a policy allows.
* **Explicit deny wins.** If any policy denies a service or tool to a subject that includes the member, the call is denied even if another policy allows it.
* **Owners and admins are exempt.** They always keep full access, so a mistaken policy cannot lock the people who can fix it out.
* **Scope.** A service-level policy covers every tool in that service. A tool-level policy covers one tool.

## Subjects

| Subject type | `subject_id`                            | Applies to                       |
| ------------ | --------------------------------------- | -------------------------------- |
| `org`        | `default`                               | every member of the organization |
| `team`       | a team id                               | every member of that team        |
| `role`       | `owner`, `admin`, `member`, or `viewer` | every member holding that role   |

## Create a policy

<Steps>
  <Step title="Open Policies">
    Go to [Dashboard > Organization > Policies](https://danubeai.com/dashboard/organization/policies). Admins and owners only.
  </Step>

  <Step title="Pick the subject and the effect">
    Choose the organization, a team, or a role, and whether the policy allows or denies.
  </Step>

  <Step title="Pick the scope">
    Choose a service (all of its tools) or a single tool.
  </Step>

  <Step title="Check the audit log">
    After the first policy exists, denied calls appear in the [audit log](/organizations/audit-log) with status `denied` and the reason. Use it to confirm the policy does what you intended before relying on it.
  </Step>
</Steps>

## Example

A support team may read and create Zendesk tickets, but nobody outside the admins may delete them:

```json theme={null}
[
  {"subject_type": "team", "subject_id": "<support-team-id>", "effect": "allow", "service_id": "<zendesk-service-id>"},
  {"subject_type": "org",  "subject_id": "default", "effect": "deny", "tool_id": "<zendesk-delete-ticket-tool-id>"}
]
```

Admins keep delete access because they are exempt from policies.

## Endpoints

| Method   | Path                                           | Body                                                                         |
| -------- | ---------------------------------------------- | ---------------------------------------------------------------------------- |
| `GET`    | `/v1/organizations/{org_id}/grants`            |                                                                              |
| `POST`   | `/v1/organizations/{org_id}/grants`            | `subject_type`, `subject_id`, `effect`, and one of `service_id` or `tool_id` |
| `DELETE` | `/v1/organizations/{org_id}/grants/{grant_id}` |                                                                              |

Validation rules: a policy needs a `service_id` or a `tool_id`; organization-wide policies must use `subject_id: "default"`; role policies must name one of the four roles.