Question 1

What is MAPL?

Accepted Answer

MAPL (MACAW Agentic Policy Language) is a declarative, JSON-based policy language designed specifically for controlling AI agent behavior. You specify what's allowed, and the engine enforces it deterministically.

MAPL covers:
- Resources - what can be accessed (LLMs, tools, data)
- Constraints - how resources can be used (parameters, rate limits, time windows)
- Attestations - approval gates for sensitive operations
- Inheritance - policies compose via extends, permissions only narrow

See the

Question 2

Do I need to learn a new language?

Accepted Answer

Not really. The Console includes a Policy Assistant - describe what you want in plain English, and it generates the MAPL.

"Allow developers to use GPT-4 with max 2000 tokens, but deny access to any files containing 'confidential'"

The assistant generates correct MAPL because the formal grammar constrains generation - the LLM checks rules as it produces tokens, so it can only output valid policies. No hallucinations, no syntax errors. The grammar bounds what's producible.

You get the precision

Question 3

Why did MACAW create a new policy language?

Accepted Answer

Existing policy languages were designed for infrastructure, not agentic AI. Agents create unique challenges:

| Challenge | Why Existing Languages Struggle |
|-----------|--------------------------------|
| Dynamic composition | Agents delegate, chain, and compose at runtime - static pre-computation doesn't work |
| Multi-perspective policies | Caller intent, system rules, app policy, and workflow delegation must combine dynamically |
| Approval gates | Sensitive operations need human-in-the-loo

Question 4

How does MAPL compare to OPA or Cedar?

Accepted Answer

OPA and Cedar are excellent for infrastructure authorization - API gateways, microservices, cloud resources. They're battle-tested and widely adopted.

But agents need more:

| Capability | OPA/Cedar | MAPL |
|------------|-----------|------|
| Static evaluation | Yes | Yes |
| Dynamic runtime composition | Limited | Native - perspectives combine at enforcement time |
| Attestations (approval gates) | Bolt-on | First-class primitive |
| Delegation with narrowing | Manual | Automatic via inherita

Question 5

What can I control with MAPL policies?

Accepted Answer

MAPL gives you five dimensions of control:

WHAT (Resources)
- Which LLMs: llm:openai/, llm:anthropic/claude-3-
- Which tools: tool:search, tool:database_
- Which data: data:public/, data:customer/

HOW (Constraints)
- Parameter restrictions: "model": ["gpt-4"], "max_tokens": {"max": 4000}
- Rate limits: "rate_limit": 100
- String patterns: "pattern": "^[a-z]+$", "max_length": 1000

WHY (Attestations & Policy Algebra)
- Required approvals: "attestations": ["manager_approval"]
- Conditional gates

Question 6

What is the anatomy of a MAPL policy?

Accepted Answer

json
{
  "policy_id": "team:engineering",
  "name": "Engineering Team Policy",
  "extends": "company:default",

"resources": [
    "llm:openai/",
    "tool:search_"
  ],

"denied_resources": [
    "data:executive/"
  ],

"constraints": {
    "rate_limit": 100,
    "parameters": {
      "llm:openai/": {
        "model": ["gpt-3.5-turbo", "gpt-4"],
        "max_tokens": {"max": 4000}
      }
    }
  },

"attestations": ["identity_verified"]
}

| Section | Purpose |
|---------|---------|
|

Question 7

Why both whitelist (resources) and blacklist (denied_resources)?

Accepted Answer

Two reasons:

1. Whitelist forces explicit scope
By requiring resources to enumerate what's allowed, administrators must consciously decide what's in scope. Anything not listed is automatically denied. No "forgot to block it" vulnerabilities.

2. Blacklist protects sensitive assets across delegation
As policies compose through multi-step workflows and delegation chains, certain assets must remain protected regardless of what permissions flow through. denied_resources ensures critical resources (

Question 8

Does MAPL support overrides?

Accepted Answer

No. This is deliberate.

Overrides break provability. The moment you allow arbitrary overrides, you lose the formal guarantees that make MAPL's security deterministic. Theorems about policy behavior no longer hold. You're back to "trust me, the admin knows what they're doing."

The pattern instead: time-bounded groups

Need emergency access? Create a temporary policy with a validity period:

json
{
  "policy_id": "emergency:incident-1234",
  "extends": "acme:base",
  "resources": ["data:producti

Question 9

How does policy inheritance work?

Accepted Answer

Policies can extend other policies:

json
{
  "policy_id": "user:alice",
  "extends": "team:engineering",
  "constraints": {
    "rate_limit": 50
  }
}

Alice inherits engineering team's permissions but with a lower rate limit.

Key principle: Inheritance can only narrow, never expand. A child policy cannot grant more access than its parent. This monotonic narrowing is what makes delegation safe - you can't escalate privileges through the inheritance chain.

Question 10

How do policies compose when multiple apply?

Accepted Answer

Policies intersect dynamically (most restrictive wins):

| Field | Merge Rule |
|-------|------------|
| resources | Intersection (both must allow) |
| denied_resources | Union (either can deny) |
| constraints.parameters | Most restrictive (min of maxes, max of mins) |
| denied_parameters | Union (either can deny) |
| rate_limit | Minimum |

Example:
- Company: max_tokens: 4000
- Team: max_tokens: 2000
- User: max_tokens: 1000
- Effective: max_tokens: 1000

This happens at runtime, combining ca

Question 11

Can I require approval before certain actions?

Accepted Answer

Yes, using attestations. These can be human approvals or programmatic validations:

json
{
  "attestations": [
    "identity_verified",
    "manager_approval::{params.amount > 10000}"
  ]
}

This requires identity verification for all actions, and manager approval for high-value transactions.

Attestation metadata can specify approval criteria, timeouts, and whether approvals are one-time or reusable (grants):

json
{
  "constraints": {
    "attestations": {
      "manager_approval": {

Question 12

How do wildcards work in MAPL?

Accepted Answer

| Pattern | Matches |
|---------|---------|
|  | Any characters except / |
|  | Any characters including / |

Examples:
- tool: matches tool:search, tool:analyze
- tool: matches tool:openai/chat.completions
- sales matches quarterly_sales_report.txt

Question 13

How do I validate policies?

Accepted Answer

In the Console:
1. Go to Policies tab
2. Create or edit a policy
3. The system validates structure and syntax automatically
4. Use the Policy Assistant to explain what a policy does in plain English

For programmatic validation, see the [MAPL Schema Reference](/docs/policies/schema).

Policy Basics (MAPL)