What is a Policy Violation?
When an AI agent attempts a tool call that violates a YAML-defined policy — calling a denied tool, passing disallowed arguments, or exceeding rate limits. Violations are blocked by Intercept before reaching the MCP server, logged with full context, and can trigger alerts.
WHY IT MATTERS
Policy violations are the system working as intended — a control catching an unauthorised tool call before it executes. They are signals, not failures.
Violations can indicate: normal operation (agent hitting legitimate rate limits), misconfiguration (policies too restrictive for the task), bugs (agent constructing wrong tool calls), or attacks (prompt injection attempting to invoke dangerous tools).
How you respond to violations matters. A few violations from hitting rate limits? Adjust policies. An agent repeatedly trying to invoke a denied tool? Investigate immediately — it could be a prompt injection attempt or a malfunctioning agent loop.
HOW POLICYLAYER USES THIS
Intercept blocks and logs every policy violation with full context — the attempted tool call, which policy rule was violated, the tool arguments, and the timestamp. Violations are returned to the client as structured error responses, enabling the agent to understand why a call was denied and adjust its behaviour.