---
title: "Describe the policy authoring cascade + per-transport runtime resolution"
method: GET
path: "/v1/policies/capabilities"
tags: ["policies"]
---

# Describe the policy authoring cascade + per-transport runtime resolution

`GET /v1/policies/capabilities`

## Response `200`

Successful Response

- PolicyCapabilitiesResponse — The full policy capability table (static, org-independent). ``points`` is the channel-blind authoring cascade; ``resolutions`` is the non-authored runtime-resolution section (per-transport strategy + consequence) for the behavior preview; ``check_types`` is the presentation metadata for every check kind.
  - `points` PolicyPointCapability[], required
    - `enforcement_point` 'input' | 'pre_tool' | 'post_tool' | 'agent_response', required — Where in a turn a policy's check fires (v2: one point per policy). ``agent_response`` is the single author-facing reply point — the v1 ``response`` (per-streamed-unit) + ``post_response`` (complete reply) split is an internal runtime detail now, selected by the platform-derived enforcement strategy (buffer-and-gate vs per-unit), not an authored distinction.
    - `description` string, required
    - `checks` PolicyPointCheckCapability[], required
      - `check_type` 'expression' | 'llm_judge', required — How a policy decides whether content/state violates it. - ``expression``: a ``PolicyExprEvaluator`` boolean over turn state. - ``llm_judge``: a secondary LLM (via model_router) judges against ``guardrail_text``.
      - `strictness_options` string[], required
      - `cost_note` string, nullable
    - `actions` PolicyActionCapability[], required
      - `action` 'block' | 'redact' | 'append' | 'require_approval' | 'handoff', required — What happens when a check fails. - ``block``: emit a canned safe message, raise ``PolicyViolationError``, short-circuit. - ``redact``: deterministic regex/truncate (NO LLM rewrite). - ``append``: append a disclaimer. - ``require_approval``: route through the HITL approval seam (``pre_tool`` only). - ``handoff``: hand off via ``HandoffService`` (source="policy"). The v1 ``monitor`` action is gone — observe-only is the ``monitor`` *mode* now.
      - `label` string, required
      - `degradation_note` string, nullable
      - `config_requirements` string[]
      - `warning` string, nullable
      - `warning_applies_to_checks` string[], nullable
      - `supports_judge_message` boolean
    - `supports_tool_target` boolean
  - `resolutions` ResolutionEntry[], required
    - `enforcement_point` 'input' | 'pre_tool' | 'post_tool' | 'agent_response', required — Where in a turn a policy's check fires (v2: one point per policy). ``agent_response`` is the single author-facing reply point — the v1 ``response`` (per-streamed-unit) + ``post_response`` (complete reply) split is an internal runtime detail now, selected by the platform-derived enforcement strategy (buffer-and-gate vs per-unit), not an authored distinction.
    - `transport_class` string, required
    - `strictness` string, required
    - `check_type` 'expression' | 'llm_judge', required — How a policy decides whether content/state violates it. - ``expression``: a ``PolicyExprEvaluator`` boolean over turn state. - ``llm_judge``: a secondary LLM (via model_router) judges against ``guardrail_text``.
    - `strategy` string, required
    - `consequence` string, required
  - `check_types` PolicyCheckCapability[], required
    - `check_type` 'expression' | 'llm_judge', required — How a policy decides whether content/state violates it. - ``expression``: a ``PolicyExprEvaluator`` boolean over turn state. - ``llm_judge``: a secondary LLM (via model_router) judges against ``guardrail_text``.
    - `label` string, required
    - `hint` string, required
  - `cross_cutting` PolicyCrossCuttingFact[], required
    - `key` string, required
    - `note` string, required

## Other responses

- `400` — Bad request
- `401` — Authentication required

---

[API](https://skmtc.net/oneloop-hq/apis/feather-api.md) · [All operations](https://skmtc.net/oneloop-hq/apis/feather-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/oneloop-hq/feather-api/revisions/9cd7291d4228/schema)