Policy Precedence

WitnessAI employs a “first-match” or “top-down” policy processing approach.

In this approach, User Prompts and Model Responses are checked by each Policy in the order Policies are listed on the Policy console, from top to bottom.

The first, or top-most Policy that matches the Prompts, and the combination of Policy and guardrail attributes such as: Source (Users and/or Groups), Destination (Providers, Applications, Models, and/or Lists), Prompt, Intent, Behavior, and Response (in the case of the Harmful Response Prevention guardrail), will perform the guardrail actions configured in the Policy.

After the first match, the User Prompt will not be checked by any more policies in the list.

This is why the Application Access Policy is pinned to the top of the Policy list. Earlier releases called it the Global Block Policy (GBP). Any AI service on the Blocked Applications list (see Lists) is enforced by this policy, and all its traffic is blocked. Since the traffic will be blocked, no further Policies and guardrails will be applied.

The Attachment Block Policy (ABP) is pinned just below the Application Access Policy. Full ABP details are on the File Attachments page.

Where the agentic capability is enabled, the Agent Tool Use Policy is pinned below the ABP. It controls access to MCP servers and tools. The default policy stays at the bottom of the list. Pinned policies can't be reordered.

Policy precedence decides which policy applies. When more than one guardrail in that policy detects something in the same interaction, WitnessAI applies the single strictest action, in this order:

For example, a prompt that triggers a Warn on one guardrail and a Block on another is blocked.

If a guardrail can't finish evaluating, for example because of an error, the interaction isn't blocked on that basis. WitnessAI records a Warn-level outcome and doesn't show that warning to the user. Use a Block action for the conditions you need enforced.

You change precedence by reordering the list on the Policies page. Drag a policy up or down, then click Save, or click Undo to discard the change. Pinned policies and the default policy can't be moved.