Attachments and inheritance

Attachments bind a policy to a scope. Nothing is enforced until at least one attachment exists.

Scope types

Scope	Applies to
ORGANIZATION	Every key in the org
TEAM	Every key on the team
VIRTUAL_KEY	That key only
ACCESS_GROUP	Keys minted with that access group
MODEL_GROUP	Requests whose model group matches

Inheritance

When more than one policy could apply, they combine along:

organization → team → key

A key therefore inherits org-wide and team-wide policies plus anything attached directly to it (or to its access group / model group). The Keys table shows attached policies and where each one came from.

How to attach

1. Open Guardrails → Policies
2. Open the policy
3. Use Attachments — pick a scope type and the org / team / key / group
4. Save

The Guardrails page Attachments stat counts these bindings. Zero means the policy is defined but idle.

Gateway behavior

Pre-request steps run after auth, budget and rate-limit checks and before the provider is called. Post-request steps run on the completion. A blocking decision returns 403 guardrail_blocked and is recorded on the spend log.