---
title: "Propose a business policy. An ordinary agent can never activate a safety gate."
method: POST
path: "/policies"
---

# Propose a business policy. An ordinary agent can never activate a safety gate.

`POST /policies`

## Request

- Base URL: `https://forbiz.io/api/public/agent`
- URL: `https://forbiz.io/api/public/agent/policies`
- Auth: HTTP bearer

Capability: policies:propose. A DENY or REQUIRE_APPROVAL policy submitted by an ordinary read+write credential is stored as PROPOSED and is NOT enforced; it becomes ACTIVE only after a human workspace owner/admin confirms it in Forbiz, or when the credential holds the delegated policies:manage capability. ADVISORY policies may be created directly. Passing a confirmedBy name is provenance, not authority: it never activates anything.

## Request body

- object
  - `policyKey` string
  - `effect` 'DENY' | 'REQUIRE_APPROVAL' | 'ALLOW' | 'ADVISORY'
  - `appliesTo` string
  - `humanDescription` string
  - `statedBy` string
  - `confirmedBy` string
  - `effectiveFrom` string
  - `expiresAt` string

## Response `200`

Policy stored (check status: PROPOSED means not enforced)

- object

## Other responses

- `208`: Idempotent replay of a previous request with the same Idempotency-Key. Nothing was applied again.
- `403`: Activation requires human or delegated authority

---

[API](https://skmtc.dev/forbiz/apis/forbiz-external-agent-api.md) · [All operations](https://skmtc.dev/forbiz/apis/forbiz-external-agent-api/llms.txt) · [OpenAPI document](https://skmtc.dev/forbiz/apis/forbiz-external-agent-api/revisions/e5b10d59dc5f?raw)