Rules API

Enforcement Rules

Create, read, update, and delete enforcement rules programmatically. Rules are evaluated in priority order (highest first) and the most restrictive decision wins. Most teams declare outcomes in the Charter and let Xybern compile the rules; this API is the low-level surface for reading and managing the raw rules directly.

GET /v1/enforce/rules List all rules for the workspace, ordered by priority. POST /v1/enforce/rules Create a single enforcement rule. PUT /v1/enforce/rules/{id} Update an existing rule. DELETE /v1/enforce/rules/{id} Delete a rule.

The older /v1/enforce/policies paths remain as back-compatible aliases.

Rule Types

Type	What It Does	Conditions
action_type	Matches actions by name	Uses action_types field (supports wildcards: delete_*)
threshold	Blocks agents below a trust level	Uses trust_threshold field
content_pattern	Regex match on action content	conditions.patterns: array of regex strings
semantic	LLM judges action intent against a plain-English rule, catches paraphrase/obfuscation regex can't	conditions.semantic_rule, conditions.min_confidence, conditions.on_unavailable (details)
sequence	Stateful, judges a pattern across an agent's recent actions, not one action (velocity bursts, A→B exfil)	velocity: {mode, window_seconds, max_count, match_action_types}; ordered: {mode:"ordered", window_seconds, steps:["read_*","send_*"]}
temporal	Time/day restrictions	conditions.blocked_hours: [0-23], conditions.blocked_days: [1-7]
chain_of_custody	Agent chain depth/agent rules	conditions.max_chain_depth, conditions.forbidden_agents

Create Rule Example

# Block trades containing sensitive keywords
policy = requests.post(
    "https://www.xybern.com/api/v1/enforce/rules",
    headers={"X-API-Key": API_KEY},
    json={
        "name": "Block Insider Trading Keywords",
        "description": "Block any trade with insider-related language",
        "policy_type": "content_pattern",
        "decision": "block",
        "priority": 200,
        "action_types": ["execute_trade", "modify_order"],
        "conditions": {
            "patterns": [
                "insider.*info",
                "material.*non-public",
                "tip.*from.*executive"
            ]
        }
    }
).json()

# Block all activity on weekends
weekend_policy = requests.post(
    "https://www.xybern.com/api/v1/enforce/rules",
    headers={"X-API-Key": API_KEY},
    json={
        "name": "Weekend Trading Lockout",
        "policy_type": "temporal",
        "decision": "block",
        "priority": 300,
        "action_types": ["execute_trade"],
        "conditions": {"blocked_days": [6, 7]}
    }
).json()