diff --git a/src/pages/docs/platform-hub/policies/examples.md b/src/pages/docs/platform-hub/policies/examples.md index dd25242115..29ac817d79 100644 --- a/src/pages/docs/platform-hub/policies/examples.md +++ b/src/pages/docs/platform-hub/policies/examples.md @@ -1,7 +1,7 @@ --- layout: src/layouts/Default.astro pubDate: 2025-09-11 -modDate: 2026-06-19 +modDate: 2026-10-30 title: Policy examples subtitle: Ready-to-use Rego organized by what you want to enforce icon: fa-solid fa-lock @@ -79,6 +79,29 @@ manual_intervention_skipped if { } ``` +### Require a person to action manual interventions in AI agent runs + +Blocks runbook runs started by an AI agent unless they include a manual intervention step that [blocks AI agents](/docs/projects/built-in-step-templates/manual-intervention-and-approvals#block-ai-agents). Runs started by people aren't affected. + +**Conditions:** + +```ruby +package agent_runs_need_a_person + +default result := {"allowed": false, "reason": "AI agent runs need a manual intervention that blocks AI agents"} + +result := {"allowed": true} if { + input.Actor.Type != "Agent" +} + +result := {"allowed": true} if { + some step in input.Steps + step.ActionType == "Octopus.Manual" + step.BlockAiAgents == true + not step.Id in input.SkippedSteps +} +``` + ### Require a step template Blocks deployments where a specific step template is absent, disabled, or skipped. Replace `` with the ID of your step template. diff --git a/src/pages/docs/platform-hub/policies/schema.md b/src/pages/docs/platform-hub/policies/schema.md index 76d491aa4d..0d38fa4df0 100644 --- a/src/pages/docs/platform-hub/policies/schema.md +++ b/src/pages/docs/platform-hub/policies/schema.md @@ -1,7 +1,7 @@ --- layout: src/layouts/Default.astro pubDate: 2025-09-11 -modDate: 2026-09-29 +modDate: 2026-10-30 title: Schema for policies subtitle: A reference for the input schema passed to the policy engine, including field descriptions, conditional fields, and example patterns. icon: fa-solid fa-lock @@ -216,6 +216,7 @@ These two fields work together. A step that's skipped still appears in `Steps`, | Enabled | boolean | Yes | Whether the step is enabled in the process | | IsRequired | boolean | Yes | Whether the step has been marked as required | | IsConditional | boolean | Yes | Whether the step has non-default [run conditions](/docs/projects/steps/conditions) | +| BlockAiAgents | boolean | Yes | Whether a manual intervention step stops AI agents from actioning it. `false` when the setting uses a variable, because the value isn't known until the run starts | | [Source](#source-object) | object | Yes | Where the step comes from. See the Source object below | | [Packages](#packages-array) | array | No | Packages referenced by this step. Not present for Runbook runs | @@ -543,6 +544,7 @@ The complete JSON schema for the policy input object is provided below for use w "Enabled": { "type": "boolean" }, "IsRequired": { "type": "boolean" }, "IsConditional": { "type": "boolean" }, + "BlockAiAgents": { "type": "boolean" }, "Source": { "type": "object", "properties": { @@ -578,7 +580,7 @@ The complete JSON schema for the policy input object is provided below for use w } } }, - "required": ["Id", "Slug", "ActionType", "Enabled", "IsRequired", "IsConditional", "Source"] + "required": ["Id", "Slug", "ActionType", "Enabled", "IsRequired", "IsConditional", "BlockAiAgents", "Source"] } }, "Release": {