Policy Authoring - Memproof

Memproof policies are declarative YAML files that define how the system handles every memory operation. The policy engine evaluates rules in priority order — the first matching rule wins.

Policy File Structure

Every policy file has five top-level keys:

version: 0.1.0          # Semantic version of your policy
mode: enforce            # "enforce" applies rules; "audit" logs but does not block
defaults:                # Fallback behaviors
  on_policy_miss: deny
  on_adapter_error: quarantine
  require_idempotency: true
risk_thresholds:         # Score boundaries for risk levels
  low_max: 0.30
  medium_max: 0.60
  high_max: 0.80
  critical_max: 1.00
rules: []                # Ordered list of policy rules

Rule Anatomy

Each rule is a dictionary with the following fields:

- id: approve_high_risk_mutations        # Unique identifier
  description: Require approval for high risk mutations.
  enabled: true                          # Toggle without removing
  priority: 200                          # Lower number fires first
  action: require_approval               # allow | deny | require_approval | quarantine
  reason_codes: [HIGH_RISK_MUTATION]     # Machine-readable codes for audit trail
  match: all                             # "all" = AND, "any" = OR
  when:                                  # List of conditions
    - field: operation_type
      operator: in
      value: [remember, update, forget]
    - field: risk_level
      operator: in
      value: [high, critical]

Rules are sorted by priority at load time. A rule with priority 50 is evaluated before priority 200. The first match short-circuits evaluation.

Available Fields

Conditions can reference these fields from the evaluation context:

Field	Type	Example Values
`operation_type`	string	`remember`, `update`, `forget`, `search`, `get`
`risk_level`	string	`low`, `medium`, `high`, `critical`
`risk_score`	float	`0.0` - `1.0`
`scope.tenant_id`	string	`"acme-corp"`
`scope.project_id`	string	`"proj-123"`
`scope.agent_id`	string	`"agent-alpha"`
`scope.subject_id`	string	`"user-456"`
`context.source`	string	`"langgraph"`, `"mcp"`, `"api"`
`content.contains_pii`	bool	`true`, `false`
`content.contains_secret`	bool	`true`, `false`
`content.length`	int	`0` - N

Condition Operators

The policy engine supports 10 operators:

Operator	Description	Example
`eq`	Equals	`{ field: risk_level, operator: eq, value: critical }`
`neq`	Not equals	`{ field: context.source, operator: neq, value: api }`
`in`	Value is in list	`{ field: operation_type, operator: in, value: [search, get] }`
`nin`	Value not in list	`{ field: context.source, operator: nin, value: [langgraph, mcp] }`
`gt`	Greater than	`{ field: risk_score, operator: gt, value: 0.8 }`
`gte`	Greater than or equal	`{ field: content.length, operator: gte, value: 1000 }`
`lt`	Less than	`{ field: risk_score, operator: lt, value: 0.3 }`
`lte`	Less than or equal	`{ field: content.length, operator: lte, value: 500 }`
`contains`	Substring match	`{ field: scope.tenant_id, operator: contains, value: acme }`
`regex`	Regular expression match	`{ field: scope.agent_id, operator: regex, value: "^agent-.*" }`

Match Modes

all (default) — Every condition must be true (logical AND).
any — At least one condition must be true (logical OR).

Default Behaviors

Key	Values	Purpose
`on_policy_miss`	`allow`, `deny`, `quarantine`, `require_approval`	Action when no rule matches
`on_adapter_error`	`quarantine`, `deny`	Action when the backend adapter fails

Setting on_policy_miss: allow means any operation not explicitly matched by a rule will be permitted. In production, deny is the safer default.

Common Patterns

Allow Trusted Reads

- id: allow_safe_search
  description: Allow read/search from trusted runtimes.
  priority: 100
  action: allow
  reason_codes: [SAFE_READ_PATH]
  match: all
  when:
    - field: operation_type
      operator: in
      value: [search, get]
    - field: context.source
      operator: in
      value: [langgraph, openai_sessions, mcp]

Block Cross-Tenant Operations

- id: deny_cross_tenant_ops
  description: Deny operations with missing tenant scope.
  priority: 50
  action: deny
  reason_codes: [CROSS_TENANT_SCOPE_MISMATCH]
  match: any
  when:
    - field: scope.tenant_id
      operator: eq
      value: ""

Require Approval for High Risk

- id: approve_high_risk
  description: Require human approval for high/critical mutations.
  priority: 200
  action: require_approval
  reason_codes: [HIGH_RISK_MUTATION]
  match: all
  when:
    - field: operation_type
      operator: in
      value: [remember, update, forget]
    - field: risk_level
      operator: in
      value: [high, critical]

Quarantine PII from Untrusted Sources

- id: quarantine_pii
  description: Quarantine writes with PII from untrusted sources.
  priority: 160
  action: quarantine
  reason_codes: [SENSITIVE_UNTRUSTED_SOURCE]
  match: all
  when:
    - field: operation_type
      operator: in
      value: [remember, update]
    - field: context.source
      operator: nin
      value: [langgraph, openai_sessions, mcp]
    - field: content.contains_pii
      operator: eq
      value: true

Start with the example policy at examples/memproof.yaml and customize it for your threat model. Keep cross-tenant denial at the lowest priority number so it fires before anything else.

​Policy File Structure

​Rule Anatomy

​Available Fields

​Condition Operators

​Match Modes

​Default Behaviors

​Common Patterns

​Allow Trusted Reads

​Block Cross-Tenant Operations

​Require Approval for High Risk

​Quarantine PII from Untrusted Sources

Policy File Structure

Rule Anatomy

Available Fields

Condition Operators

Match Modes

Default Behaviors

Common Patterns

Allow Trusted Reads

Block Cross-Tenant Operations

Require Approval for High Risk

Quarantine PII from Untrusted Sources