What is Policy Priority?

2 min read Updated

Policy priority is the order in which policies are evaluated when multiple rules could match a tool call, with higher-priority rules overriding lower-priority ones to produce a deterministic decision.

WHY IT MATTERS

In any non-trivial policy configuration, multiple rules will match the same tool call. A server-level default says "log all tools." A tool-level rule says "deny create_charge when amount > 1000." Another tool-level rule says "allow create_charge when currency == GBP." When an agent calls create_charge with amount: 500 and currency: GBP, which rule wins?

Priority resolves this ambiguity deterministically. Every rule has a priority (explicit or implicit), and Intercept evaluates rules in priority order. The first matching rule produces the final decision. This "first match wins" model is familiar from firewall rules, CSS specificity, and routing tables — it is predictable and well-understood.

Implicit priority follows the specificity principle: tool-level rules are more specific than server-level defaults, which are more specific than global rules. Within the same level, rules are evaluated in the order they appear in the policy file. Explicit priority values can override this default ordering when needed, giving policy authors full control over evaluation order.

HOW POLICYLAYER USES THIS

Intercept assigns priority to rules based on specificity (tool > server > global) and file order. You can assign explicit priority values to override the default ordering. During evaluation, Intercept sorts matching rules by priority and applies the first match. The decision log records the full sorted rule list and which rule was selected, making priority resolution transparent and debuggable.

FREQUENTLY ASKED QUESTIONS

What happens when two rules have the same priority?
Rules at the same priority level are evaluated in the order they appear in the policy file (top to bottom). The first matching rule wins. To avoid ambiguity, assign explicit priorities when rule ordering matters for correctness.
How do I ensure a critical deny rule always takes precedence?
Place it in a global policy (highest level) or assign it the highest explicit priority value. Global deny rules cannot be overridden by any lower-level policy, making them the strongest enforcement mechanism.

FURTHER READING

Enforce policies on every tool call

Intercept is the open-source MCP proxy that enforces YAML policies on AI agent tool calls. No code changes needed.

npx -y @policylayer/intercept
github.com/policylayer/intercept →
// GET IN TOUCH

Have a question or want to learn more? Send us a message.

Message sent.

We'll get back to you soon.