Attachments and inheritance

Attachments bind a policy to a scope. Nothing is enforced until at least one attachment exists.

Scope types

Scope	Applies to
ORGANIZATION	Every key in the org
TEAM	Every key on the team
VIRTUAL_KEY	That key only
ACCESS_GROUP	Keys minted with that access group
MODEL_GROUP	Requests whose model group matches

Inheritance

When more than one policy could apply, they combine along:

organization → team → key

A key therefore inherits org-wide and team-wide policies plus anything attached directly to it (or to its access group / model group). The key details drawer on API Keys (Effective policy) shows the policies that apply and where each one came from.

How to attach

1. Open Guardrails → Policies
2. Open the policy (Open builder)
3. In Where it applies, pick a scope type under Apply to and the org / team / key / group, then select Apply

The attachment takes effect right away, using the last saved version of the policy.

The Guardrails page Attachments stat counts these bindings. Zero means the policy is defined but idle.

Gateway behavior

Pre-request steps run after auth, budget and rate-limit checks and before the provider is called. Post-request steps run on the completion. A blocking decision returns 403 guardrail_blocked and is recorded on the spend log.