Skip to content

docs: document tool exclusion from memory via deny policy #21428

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
g-samroberts merged 3 commits into from
Mar 9, 2026
Merged

docs: document tool exclusion from memory via deny policy #21428

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
36da5a7
docs: document that global deny rules remove tools from model memory …
Abhijit-2592 Mar 6, 2026
4dc5381
docs: clarify that tools.exclude is replaced by policy engine
Abhijit-2592 Mar 6, 2026
b62f3f4
Update docs/reference/policy-engine.md
g-samroberts Mar 9, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 8 additions & 1 deletion docs/reference/policy-engine.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -91,10 +91,17 @@ the arguments don't match the pattern, the rule does not apply.
There are three possible decisions a rule can enforce:

- `allow`: The tool call is executed automatically without user interaction.
- `deny`: The tool call is blocked and is not executed.
- `deny`: The tool call is blocked and is not executed. For global rules (those
without an `argsPattern`), tools that are denied are **completely excluded
from the model's memory**. This means the model will not even see the tool as
an option, which is more secure and saves context window space.
- `ask_user`: The user is prompted to approve or deny the tool call. (In
non-interactive mode, this is treated as `deny`.)

> **Note:** The `deny` decision is the recommended way to exclude tools. The
> legacy `tools.exclude` setting in `settings.json` is deprecated in favor of
> policy rules with a `deny` decision.

### Priority system and tiers

The policy engine uses a sophisticated priority system to resolve conflicts when
Expand Down
Loading