[Docs index](/docs.md) / [Tool Policies](/docs/tool-policies/overview.md) / Troubleshooting --- # Troubleshooting Common issues and solutions related to tool policies. --- ## My rule never blocks anything **The rule is not matching the calls you expect.** Check these in order: - Look at the line under the target in the rule editor. If it says no tool in the workspace matches, the tool name or tool pack is misspelled. - Check the **Path** on each condition. A warning under the field means the tool has no parameter by that name. - Check whether the rule is limited to certain **Sources**. A rule limited to **Chat** does not apply to agents. - Check the order. A rule higher in the list may be allowing the call first. Run the call through the [simulator](testing-rules-with-the-simulator.md). The trace shows which rule decided and why each of the others was skipped. --- ## A value with an asterisk does not match **Text operators match exactly what you type.** In **contains**, **equals**, **starts_with**, and **ends_with**, an asterisk is looked for as an asterisk. Wildcards only work in the **Tool pack** and **Tool** fields. To match a pattern in a value, change the operator to **matches**. For "starts with `foo bar baz`, followed by anything", use `foo bar baz.*`. --- ## The rule misses values written in a different case **Matching is case sensitive unless you say otherwise.** Tick **ignore case** on the condition. --- ## My pattern does not match text that spans several lines **In a pattern, a dot does not match a line break.** Replace `.*` with `[\s\S]*` when the value can contain line breaks, as queries and code often do. --- ## The editor rejects my pattern **The pattern is invalid or could be slow to evaluate.** The message under the field says which. Patterns with nested repetition such as `(a+)+`, patterns that refer back to an earlier group, and very long patterns are not accepted. Rewrite the pattern without them. --- ## A call gets through when a parameter is left out **not_equals, not_in, and url_host_not_in only match when the parameter is present.** If the tool allows the parameter to be omitted, add a second rule on the same tool using the **missing** operator. --- ## A subdomain is not matched by my host list **Host entries match the whole host.** `acme.com` does not cover `api.acme.com`. Start the entry with a dot, `.acme.com`, to cover the domain and its subdomains. --- ## The simulator says a call is allowed, but the real call was blocked **The two were not evaluated the same way.** Check that: - The **User** in the simulator is the person who made the call. - The **Source** matches where the call came from. - If an agent made the call, that agent is selected in **Agent (optional)**. Rules that apply to an agent are skipped otherwise. - The values in **Params JSON** are the ones from the real call. Copy them from **Execution Details** in Tool History. - The rules have not changed since the call was made. --- ## The simulator says the user is not a member of this workspace **The simulator only evaluates people who belong to the workspace.** Pick a current member. People who have been removed cannot be simulated. --- ## Everything stopped working after I changed the default **The default is set to Deny and no allow rule covers the tool.** With a default of **Deny**, every tool needs an allow rule. Set the **Default** row back to **Allow** to restore access, then add allow rules before switching again. See [Setting the workspace default](managing-the-rule-list.md#setting-the-workspace-default). --- ## A classifier rule blocks every call **The classifier is failing and the rule is set to fail closed.** Run the call through the simulator and read the classifier line in the trace. Common causes: - The classifier tool name is misspelled or the tool was removed. - The **Input** does not provide a parameter the classifier requires. - The classifier takes longer than the **Timeout**. --- ## The test in the rule editor ignores my classifier **The editor's test checks ordinary conditions only.** Save the rule and use the [simulator](testing-rules-with-the-simulator.md), which runs classifiers. --- ## I cannot move a rule **The rule is already at that end of the list, or another change is still saving.** **Move up** is unavailable on the first rule and **Move down** on the last. If both are available and nothing happens, wait a moment and try again. --- ## Saving fails with "That priority is already used by another rule" **Two rules cannot share a position.** Use **Move up**, **Move down**, or **Placement** to change the order. --- ## I changed a rule but a running agent is still blocked **A run in progress keeps the rules it started with.** The change applies on the agent's next turn or next run. --- ## I do not see New Rule or the option to create a rule from a call **You are not a workspace admin.** Members can view tool policies but cannot change them. Ask a workspace admin to make the change or to update your role. --- ## The AI keeps retrying a blocked call **The message the AI receives does not tell it what to do instead.** Edit the rule and write a clearer **Message returned to the model on deny**, such as "This table is restricted. Use the `monthly_summary` view instead." --- Still need help? Contact your workspace administrator. --- ## Navigation ### In this section: Tool Policies - [Tool Policies](/docs/tool-policies/overview.md) - [Use Cases and Playbooks](/docs/tool-policies/use-cases.md) - [Creating a Rule](/docs/tool-policies/creating-a-rule.md) - [Writing Conditions](/docs/tool-policies/writing-conditions.md) - [Using a Tool as a Classifier](/docs/tool-policies/using-a-classifier.md) - [Testing Rules with the Simulator](/docs/tool-policies/testing-rules-with-the-simulator.md) - [Creating a Rule from a Tool Call](/docs/tool-policies/creating-a-rule-from-a-tool-call.md) - [Managing the Rule List](/docs/tool-policies/managing-the-rule-list.md) - **Troubleshooting** (current) #### Playbooks - [Playbook: Build a Query Intent Classifier](/docs/tool-policies/playbook-query-intent-classifier.md) - [Playbook: Control Where Your Tools Can Send Data](/docs/tool-policies/playbook-outbound-request-allowlist.md) - [Playbook: Give a Scheduled Agent Only the Access It Needs](/docs/tool-policies/playbook-scheduled-agent-guardrails.md) - [Playbook: Put Guardrails on Warehouse Queries](/docs/tool-policies/playbook-warehouse-query-guardrails.md) ### Other sections - [Tool Creation](/docs/tool-creation/overview.md) - [Subagents](/docs/subagents/overview.md) - [Agent Skills](/docs/agent-skills/overview.md) - [Sandcastles](/docs/sandcastles/overview.md) - [MCP Servers](/docs/mcp-servers/overview.md) - [Scheduled Triggers](/docs/scheduled-triggers/overview.md) - [Agent Filesystem](/docs/agent-filesystem/overview.md) - [Workspace Permissions](/docs/workspace-permissions/overview.md) - [Workspace Billing](/docs/workspace-billing/overview.md) - [Chat Sharing](/docs/chat-sharing/overview.md) [Back to docs index](/docs.md)