Policies

A complete policy consists of three parts: effect, scope, and condition.

// 1. Effect: permit (allow) or forbid (deny)
permit (
  // 2. Scope: Defines the principal, action, and resource the policy applies to
  principal is AgentIdentity::OAuthUser,
  action == AIGateway::Action::"mcp-servers.order-service.refund",
  resource == AIGateway::Gateway::"acs:apig:cn-beijing:123...:gateway/gw-abc..."
)
// 3. Condition: Provides fine-grained filtering based on the request context
when {
  context.input.amount < 500
};

Effect

Specifies whether the policy permits or forbids access.

• permit: Allows access.

• forbid: Denies access. If any forbid policy matches, the request is immediately denied. Forbid policies take precedence over all permit policies.

Scope

Defines the boundaries of the policy using three elements: principal, action, and resource. The policy's condition and effect are evaluated only if a request's principal, action, and resource match those defined in the scope.

Condition

An optional element that provides dynamic, fine-grained control based on the request context. The condition clause follows the scope and supports two forms:

• when: When the expression evaluates to true, the policy takes effect.

• unless: If the expression evaluates to true, the policy does not take effect (negative condition). You must use the script editor to configure this.

Request context (context)

The request context object contains attributes about the request that you can use in a policy's condition clause. The following table lists the supported context attributes and their operators.

Logical operators

You can use logical operators to combine multiple conditions:

• && (AND): All conditions must be met.

• || (OR): At least one condition must be met.

• ! (NOT): Negates the condition.

Example: when { context.input.amount < 500 || ip(context.sourceIp).isInRange(ip("192.168.1.0/24")) }.

Example 1: Control access by MCP parameters

Allows calls to the refund API (refund), but the amount of a single refund must be less than 500.

permit (
  principal is AgentIdentity::OAuthUser,
  action == AIGateway::Action::"mcp-servers.payment-service.refund",
  resource == AIGateway::Gateway::"acs:apig:cn-beijing:{account_id}:gateway/{gateway_instance_id}"
)
when { context.input.amount < 500 };

Example 2: Control access by IP whitelist

Permit access to a sensitive data query tool only for requests originating from a specific internal network segment (such as 10.0.0.0/8) or a corporate public egress IP range.

permit (
  principal is AgentIdentity::OAuthUser,
  action == AIGateway::Action::"mcp-servers.data-service.query",
  resource == AIGateway::Gateway::"acs:apig:cn-beijing:{account_id}:gateway/{gateway_instance_id}"
)
when { ip(context.sourceIp).isInRange(ip("10.0.0.0/8")) };

Example 3: Grant a specific user MCP tool access

Allows OAuth users with a sub value of iiCsOvhjNZX/hK0x1jl9**** to call the create-order and get-order tools of the Order MCP service.

permit (
  principal == AgentIdentity::OAuthUser::"iiCsOvhjNZX/hK0x1jl9****",
  action in [AIGateway::Action::"mcp-servers.order-service.create-order", AIGateway::Action::"mcp-servers.order-service.get-order"],
  resource == AIGateway::Gateway::"acs:apig:cn-beijing:{account_id}:gateway/{gateway_instance_id}"
);

Example 4: Deny a specific action (blacklist)

Forbid all users from calling the data deletion API. Because forbid policies have the highest precedence due to the deny overrides principle, this action is denied even if a permit policy also applies.

forbid (
  principal,
  action == AIGateway::Action::"mcp-servers.system-service.delete_data",
  resource == AIGateway::Gateway::"acs:apig:cn-beijing:{account_id}:gateway/{gateway_instance_id}"
);

Example 5: Use reverse exclusion with 'unless'

Allow all users to call the query tool, but exclude requests from a specific IP address (192.168.1.100).

permit (
  principal,
  action == AIGateway::Action::"mcp-servers.data-service.query",
  resource == AIGateway::Gateway::"acs:apig:cn-beijing:{account_id}:gateway/{gateway_instance_id}"
)
unless {
  ip(context.sourceIp) == ip("192.168.1.100")
};