Policy Precedence

WitnessAI employs a “first-match” or “top-down” policy processing approach.

In this approach, User Prompts and Model Responses are checked by each Policy in the order Policies are listed on the Policy console, from top to bottom.

The first, or top-most Policy that matches the Prompts, and the combination of Policy and GuardRail attributes such as: Source (Users and/or Groups), Destination (Providers, Applications, Models, and/or Lists), Prompt, Intent, Behavior, and Response (in the case of the Harmful Response Prevention Guardrail), will perform the GuardRail Actions configured in the Policy.

After the first match, the User Prompt will not be checked by any more policies in the list.

This is why the Global Block Policy (GBP) is pinned to the top of the Policy list. Any AI service that is on the Blocked Apps List will be automatically added to the GBP and all traffic will be blocked. Since the traffic will be blocked, no further Policies and GuardRails will be applied.

The Attachment Block Policy (ABP) is pinned just below the GBP. Full ABP details are on the File Attachment page.