% Generated by roxygen2: do not edit by hand
% Please edit documentation in R/policy.R
\name{build_policy}
\alias{build_policy}
\title{Build a guardrail policy}
\usage{
build_policy(
  name = "custom",
  rules = list(),
  thresholds = list(),
  rate_guard = NULL,
  controls = NULL
)
}
\arguments{
\item{name}{Policy name.}

\item{rules}{A list of \code{shieldr_rule} objects.}

\item{thresholds}{Threshold overrides. Missing values are filled from
\code{redact_at = 0.4} and \code{block_at = 0.75}.}

\item{rate_guard}{Optional \code{shieldr_rate_guard}. When present, \code{\link[=secure_chat]{secure_chat()}}
checks the guard before chat calls and updates it after successful calls.}

\item{controls}{Optional controls from \code{\link[=policy_controls]{policy_controls()}}.}
}
\value{
A \code{shieldr_policy}.
}
\description{
\code{build_policy()} combines validated \code{shieldr_rule} objects with threshold
settings for the scanner layer. OWASP LLM Top 10 references are preserved on
each rule; see \url{https://genai.owasp.org/llm-top-10/}.
}
\details{
A policy is intentionally small and inspectable. It contains a policy name,
a list of deterministic rules, threshold values, and an optional rate guard.
The scanners do not mutate a policy; they read the rule list, create
findings, calculate a risk score from finding severities, and then compare
that score with the policy thresholds.

\code{controls} configures \code{\link[=secure_chat]{secure_chat()}} orchestration behavior after a report
has already resolved to \code{block}. For example, a policy can refuse blocked
prompts with a user-facing message, drop blocked RAG rows, or mark blocked
output for human review.

Thresholds are merged over the package defaults:
\itemize{
\item \code{redact_at = 0.4}
\item \code{block_at = 0.75}
}

Lower thresholds make a policy stricter. Higher thresholds make accumulated
findings less likely to escalate. Critical findings and explicit \code{block}
rules still block regardless of threshold.
}
\examples{
policy <- build_policy(rules = list(rule_pii_email()))
policy
}
