Policies
The policy object that decides what an organization may call, where it may run and what it may spend, field by field.
A policy is stored per organization and read on every inference request. The defaults are the safe ones: EU-owned or EU-region hosting, zero retention, public and internal data only, a trace required.
Fields
| Field | Storage | Default | What it decides |
|---|---|---|---|
| residency_allowed | JSON array | ["eu_owned_eu_operated","eu_region_of_non_eu_parent"] | Which hosting classes an endpoint may have. A filter, not a preference: an endpoint outside the list is never chosen. |
| providers_allow | JSON array | [] — any | Empty means any provider. A non-empty list becomes an allow list. |
| providers_deny | JSON array | [] | Providers that may never be used, checked before the allow list. |
| models_allow | JSON array | [] — any | Empty means any model. A non-empty list becomes an allow list. |
| models_deny | JSON array | [] | Models that may never be used. |
| max_usd_per_1m | REAL, nullable | null — no cap | Highest blended price per million tokens an endpoint may cost. Above it, the endpoint is rejected. |
| max_usd_per_day | REAL, nullable | null — no cap | Daily spend ceiling for the organization. Reaching it answers 402 budget_exceeded. |
| retention | TEXT | zero | Allowed prompt retention. Only zero is implemented: any other value the policy allows makes the request fail rather than store something. |
| data_classes_allowed | JSON array | ["public","internal"] | Data classes a request may declare. A class outside this list is refused. |
| require_trace | INTEGER 0/1 | 1 | Whether every inference call leaves a trace row. At zero retention a trace holds metadata, never a prompt body. |
| allow_partner_endpoints | INTEGER 0/1 | 0 | Whether endpoints operated by a non-EU parent may be used. Off by default. |
| json_logic | JSON, nullable | null | Reserved for a future custom rule. Nothing reads it today, so it changes no decision. |
Which policy applies
A request may name one with llmeu.policy_id. Without it, the organization's default policy applies. A policy_id that belongs to another organization is refused with policy_not_found, because the lookup is always scoped to the organization the key belongs to.
"llmeu": { "policy_id": "the-uuid-from-the-console" }Because the default policy applies to every key, an organization's residency promise is not something a caller can opt out of by omitting a field.
The order the rules run in
Endpoint kind first — a catalogue-only entry is rejected before anything else — then status, then the residency class and region, then the provider and model lists, then the partner rule, vision, context size and price. The full sequence, with the failure code each step produces, is on the routing page.
Editing
In the console, or with PUT /platform/v1/policies/{id} using a key that carries platform_write. A change applies to the next request; a request already in flight keeps the policy it started under.