What is a Policy Override?

Rigid policies that cannot accommodate exceptions are impractical. Real operations require flexibility: a one-time payment above the normal limit, emergency access to a restricted tool during an incident, a temporary exemption while migrating between systems. Overrides provide this flexibility without undermining the policy framework.

The key distinction between overrides and simply editing policies is auditability and scope. An override is explicitly marked as an exception — it appears in the audit trail with a reason, an expiry, and the identity of who authorised it. Editing the base policy changes the rules for everyone permanently, which might not be the intent. Overrides are surgical; policy edits are systemic.

Overrides also enable operational workflows that static policies cannot. A human-in-the-loop approval can be implemented as a time-limited override: the agent requests access, a human approves it via an external system, and a scoped override is created that expires after the approved operation completes. This bridges the gap between fully autonomous and fully supervised agent operation.

Intercept supports overrides as high-priority rules that take precedence over the base policy. Overrides can be scoped to a specific tool, server, agent, or argument pattern, and can include an expiry time after which they are automatically removed. Every override is logged in the audit trail with metadata including the reason, authoriser, and creation timestamp. Overrides can be managed via policy files (for persistent exceptions) or via Intercept's API (for dynamic, time-limited exemptions).