> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/web-application-and-api-protection-waap/discovery/settings/issue-policies.md).
# Policies
Updates (July 2026 to September 2026)
* *September 2026* — Updated the page to reflect the updated **Policies** page, including the API, MCP, and custom tabs. For more information, see [Policy Categorization](#policy-categorization1).
The **Policies** page helps you identify API and MCP assets that violate security or compliance requirements. Traceable provides predefined policies for OWASP API Top 10, OWASP LLM Top 10, OWASP MCP Top 10, and PCI DSS. You can also define your own policies to detect violations based on attributes, such as vulnerability type, data sensitivity, and endpoint behavior, and enable or disable any policy according to your requirements.
### **What you will learn from this topic**
By the end of this topic, you will be able to:
* Understand how Traceable uses policies to identify security and compliance violations across API and MCP assets.
* Understand how policies are organized across the API, MCP, and Custom tabs.
* Review policy details, including framework references, severity, environments, and status.
* Configure predefined policies by defining their scope, detection conditions, and severity.
* Create and manage custom policies.
* Review policy violations and identify the corresponding issues on the Issues page.
***
### Understand policies
Traceable evaluates every policy against your API and MCP traffic and lists the resulting violations as issues. The following table provides an overview of policies, including their purpose, how they work, and how you can use them in Traceable:
| **When to use?** | **Why use it?** | **How can you leverage it?** |
| ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| It can be used when you want to know whether your APIs and MCP assets are covered against a given framework, for example, before an audit, or when you want to detect a violation. | It helps you identify security and compliance violations across your API and MCP assets without manually reviewing traffic against every framework requirement. | You can use the policies page to review predefined coverage by framework, tune a policy's scope and severity to your traffic, or create a custom policy for detection logic according to your requirements. |
***
### Policy categorization
Traceable groups every policy by the type of asset it protects, rather than by the framework it belongs to. This allows a single policy to map to multiple frameworks, for example, *PCI DSS* and *OWASP API Top 10*, without being duplicated or hidden under the wrong tab. The following table discusses the tabs and how they differ:
| **Comparison Metric** | **API** | **MCP** | **Custom** |
| ---------------------- | --------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------- | ----------------------------------------------------------------------- |
| **Purpose** | Detects predefined violations across API endpoints, including AI APIs. | Detects predefined violations across MCP Tools, MCP Resources, and MCP Prompts. | Detects violations you define using your own attributes and conditions. |
| **Frameworks covered** | OWASP API Top 10, OWASP LLM Top 10, PCI DSS. | OWASP MCP Top 10 | Not applicable; you define the detection logic directly. |
| **Lifecycle** | Provided out of the box by Traceable, you can edit the scope, conditions, and severity. | Provided out of the box by Traceable, you can edit the scope, conditions, and severity. | Created, edited, and deleted by you. |
For more information, see [Policy view](#policy-view) and [Configure policies](#configure-policies1).
***
### Policy view
The Policy view provides a centralized overview of all policies, including their framework mappings, severity, applicable environments, status, and available actions, helping you understand and manage each policy’s configuration and application.
Issue Policies
Traceable shows the following information for each tab mentioned above:
| **Column** | **Description** |
| ------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Policy Name** | The policy name, for example, *Missing Gateway Policies*. Traceable uses this policy name as the **Issue Name** on the **Issues** page. |
| **Framework References** | The specific framework codes the policy maps to, for example, `2023-API08` the OWASP API Top 10 or `PCI-DSS-4.2` for PCI DSS. A policy can map to more than one code across multiple frameworks. If a policy maps to more than a few codes, Traceable groups the remaining codes under a `+N` chip; hover over a code to see the full control name it corresponds to. |
| **Category** (Custom tab only) | The category you assigned to the policy at the time of creation. |
| **Severity** | The severity of the issue detected as part of this policy, for example, *High* or *Medium*. |
| **Environments** | The environment(s) in which the policy is applicable. By default, a policy applies to *All Environments*; however, you can edit this according to your requirements. |
| **Status** | The policy's status: **enabled** or **disabled**. While the policies are enabled (Traceable recommended) by default, you can click the toggle for a row to disable them, according to your requirements. |
| **Actions** | The functions you can perform on the policy. You can *edit, clone*, and *delete* the policy configuration according to your requirements. |
#### Filters
Use multi-select filters on each tab to narrow the policy list based on your requirements. Traceable applies AND logic across filter categories and OR logic within a category. This lets you combine multiple criteria to answer specific coverage questions, such as identifying disabled, high-severity policies that protect MCP Tools.
Each tab provides the following filters:
Policies Filter
| Tab | Available filters |
| ------ | ------------------------------------------------------------- |
| API | Is AI API, Framework, Framework References, Severity, Status |
| MCP | Asset Type, Framework, Framework References, Severity, Status |
| Custom | Severity, Status |
Each tab also includes framework chips relevant to that asset type. Select a framework chip to immediately filter the policy list to policies mapped to that framework.
* API — OWASP API Top 10, OWASP LLM Top 10, PCI-DSS
* MCP — OWASP MCP Top 10
***
### Configure policies
Traceable provides you with the flexibility to rely on predefined policies, customize them, or define your own, according to your requirements. This section highlights the recommendations on when to use these options, along with the corresponding steps.
{% hint style="success" icon="thumbs-up" %}
Traceable recommends using:
* Predefined policies under the **API** and **MCP** tabs when you want to get started quickly with Traceable-recommended coverage for OWASP and PCI DSS frameworks.
* Custom policies under the **Custom** tab when you want to detect a violation based on attributes or conditions according to your requirements.
{% endhint %}
{% tabs %}
{% tab title="System Policies" %}
Traceable, by default, provides you with policies under the **API** and **MCP** tabs. Traceable recommends enabling these policies to help identify the most common violations of PCI DSS, OWASP API Top 10, OWASP LLM Top 10, and OWASP MCP Top 10 across your API and MCP assets.
Traceable also allows you to edit a policy configuration according to your requirements. To edit a configuration, click the **Ellipsis** (⋯) icon corresponding to a policy.
#### Edit a policy
To edit a policy configuration, click the **Ellipsis** (⋯) icon → **Edit** corresponding to a policy, and complete the following steps:
Edit System Policy
**Step 1 — Scope**
1. Select the **Environment(s)** where you wish to apply the policy, for example, *All Environments*.
2. (Optional) Enable the **Advanced Settings** toggle if you wish to use *SPAN* attributes for configuring the conditions below.
3. Define the policy scope by configuring the condition groups. You can add one or more condition groups according to your requirements:
1. Select how Traceable should match the condition groups:
* **Match All** — Traceable performs an AND operation between the condition groups, if selected.
* **Match Any** — Traceable performs an OR operation between the condition groups, if selected.
2. Click **+ Condition Group** and complete the following steps:
1. Select how Traceable should match the conditions: *Match All* or *Match Any*.
2. Click **+ Add condition**.
3. Select or specify the **Attribute** for which you wish to apply the condition.
4. Select the **Operator** corresponding to the attribute.
5. Select or specify the **Value(s)** corresponding to the attribute and operator.
6. (Optional) Click **+** corresponding to a condition to add more according to your requirements.
3. (Optional) Repeat the above step to add more condition groups.
4. Click **Next**.
**Step 2 — Parameters**
Select the **Attribute**, and its corresponding **Operator**, and specify the **Value** based on which Traceable should detect issues for the policy. Further, click **Next**.
{% hint style="info" %}
The availability of the configurations in this step depends on the policy you are editing.
{% endhint %}
**Step 3 — Severity Conditions**
Select the **Severity** that Traceable should assign to the issues detected using the policy, and click **Save**.
{% endtab %}
{% tab title="Custom policies" %}
You can create custom policies by selecting the attributes according to your requirements. Traceable uses these policies, identifies their corresponding violations, and lists them on the **Issues** page for you to take action.
#### Create a custom policy
To create a custom policy, navigate to the **Custom** tab, click **+ Custom Policy**, and complete the following steps:
Scope of Custom Policy
**Step 1 — Scope**
1. Specify the policy **Name**. Traceable uses this policy name as the **Issue Name** on the **Issues** page.
2. Specify a **Description** for the policy.
3. From the **Environment** drop-down list, select the environment(s) in which the policy should apply. By default, Traceable selects *All Environments*.
4. Define the policy **Scope** by configuring the condition groups. You can add one or more condition groups according to your requirements:
1. Select how Traceable should match the condition groups:
* **Match All** — Traceable performs an AND operation between the condition groups, if selected.
* **Match Any** — Traceable performs an OR operation between the condition groups, if selected.
2. Click **+ Condition Group** and complete the following steps:
1. Select how Traceable should match the conditions: *Match All* or *Match Any*.
2. Click **+ Add condition**.
3. Select the **Attribute** for which you wish to apply the condition.
4. Select the **Operator** corresponding to the attribute.
5. Select the **Value(s)** corresponding to the attribute and operator.
6. (Optional) Click **+** corresponding to a condition to add more according to your requirements.
3. (Optional) Repeat the above step to add more condition groups.
5. Click **Next**.
**Step 2 — Detection Conditions**
Detection Condition
1. In the **API Attribute** section, click **+ Add condition**, then select the attribute based on your requirements. For example, *Endpoint Name* is equal to (*=*) *GET /userinfo/json*.
2. In the **Vulnerability Attribute** section, click **+ Add condition** and select the attribute according to your requirements. For example, Vulnerability *Status* is (*IN*) either *Open* or *Under review*.
3. In the **Datatypes** section, click **+ Add condition** and select the attributes according to your requirements. For example, *Request & Response* of the API endpoint contains either (*Contains any of*) the *Credit Card PIN*, *username*, and *password* data types.
4. In the **Datasets** section, click **+ Add condition** and select the attributes according to your requirements. For example, the *Response* of the API endpoint does not contain either (*Contains any of*) the *Generic Personal Info* or *PII UK* data sets.
5. In the **Data Sensitivity** section, click **+ Add condition** and select the attributes according to your requirements. For example, the *Request* data for an API endpoint is highly sensitive (*High*).
6. Click **Next**.
{% hint style="info" %}
Traceable carries out an AND operation between the conditions defined above.
{% endhint %}
**Step 3 — Severity Conditions**
Select the **Severity** that Traceable should assign to the issues detected using the policy, and click **Submit**.
{% endtab %}
{% endtabs %}
***
### List identified issues
While the **Policies** page lists the policies themselves, the violations they detect appear on the **Issues** page under **Discovery** → **Issues**. From there, you can review each violation and the API or MCP asset where Traceable identified it. For more information, see Issues Overview.
{% hint style="info" %}
The policies on this page only identify violations across discovered assets. To actively protect your APIs based on these findings, you can create policies under API Protection. For more information, see [Custom Policy](/web-application-and-api-protection-waap/protection/settings/custom-policies.md).
{% endhint %}
***
### Manage custom policies
To manage a custom policy, click the **Ellipsis** (⋯) icon corresponding to a row. The following table explains the actions available for managing a custom policy:
| **Action** | **Description** |
| ---------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Edit** | Modify the policy to add or remove any attributes according to your requirements. |
| **Clone** | Duplicate the policy to add or remove any attributes according to your requirements. While cloning a policy, you can also select if you wish to edit the cloned policy directly. Upon selection, Traceable automatically opens the policy configuration for modifications. |
| **Delete** |
.png)
