---
title: "Create a workspace policy rule (owner only) [write]"
method: POST
path: "/universes/{slug}/policies"
---

# Create a workspace policy rule (owner only) \[write\]

`POST /universes/{slug}/policies`

## Request

- Base URL: `https://api.agentsky.dev/v1`
- URL: `https://api.agentsky.dev/v1/universes/{slug}/policies`
- Auth: HTTP bearer

A rule {name, kind: "CAPABILITY", config: {"platform.orchestration": "deny"}} stops every session of the workspace from bringing in other agents as helpers (403 hiring_disabled to the agent; helpers it already has can still be listed, collected and stopped), and sessions created afterwards are not told how to hire. Disable or delete the rule to turn hiring back on.

## Path parameters

- `slug` string, required

## Request body

- union: One rule, chosen by `kind`. TOOL_CALL: {action: allow|ask|deny, matcher?: tool names joined by |, commandPatterns?: shell globs}. SPEND_CAP: {hardCapUsdMicros, warnUsdMicros?} per session, warn below the cap. CALL_COUNT: {limitPerSession}. CAPABILITY: {<capability id>: allow|ask|deny}; platform.* ids accept allow or deny.
  - object
    - `name` string, required
    - `enabled` boolean
    - `position` integer
    - `kind` 'TOOL_CALL', required
    - `config` object, required
      - `action` 'allow' | 'ask' | 'deny', required
      - `matcher` string
      - `commandPatterns` string[]
  - object
    - `name` string, required
    - `enabled` boolean
    - `position` integer
    - `kind` 'SPEND_CAP', required
    - `config` object, required
      - `warnUsdMicros` integer, nullable
      - `hardCapUsdMicros` integer, required
  - object
    - `name` string, required
    - `enabled` boolean
    - `position` integer
    - `kind` 'CALL_COUNT', required
    - `config` object, required
      - `limitPerSession` integer, required
  - object
    - `name` string, required
    - `enabled` boolean
    - `position` integer
    - `kind` 'CAPABILITY', required
    - `config` object, required

## Response `201`

Created

- object
  - `rule` PolicyRule
    - `id` string, required
    - `name` string, required
    - `kind` 'TOOL_CALL' | 'SPEND_CAP' | 'CALL_COUNT' | 'CAPABILITY', required
    - `enabled` boolean, required
    - `config` object, required
    - `layer` 'workspace' | 'agent' | 'session', required
    - `position` integer, required
    - `createdAt` string, date-time, required
    - `updatedAt` string, date-time, required

## Other responses

- `default`: Error — { error: { code, message, request_id } }

## Changes

- **2026-11-02** `e5e8f0229a99`: 1 breaking, 14 info
  - the request's body type changed from `object` to no type
  - added `subschema #1, subschema #2, subschema #3, subschema #4` to the request body `oneOf` list
  - added the optional property `error/request_id` to the response with the `default` status
  - the response property `error` became required for the status `default`
  - …11 more

[Operation history](https://skmtc.dev/agentsky/apis/agentsky-developer-api/changes/universes/:slug/policies/post.md)

---

[API](https://skmtc.dev/agentsky/apis/agentsky-developer-api.md) - [All operations](https://skmtc.dev/agentsky/apis/agentsky-developer-api/llms.txt) - [OpenAPI document](https://skmtc.dev/agentsky/apis/agentsky-developer-api/revisions/0d435187cd55?raw)