SHRIKECustom policy
A custom policy is a rule an operator writes to extend the built-in detection: a pattern, the action to take (observe, warn, require approval, or block), a severity, and the scan stages it applies to. Written once in the dashboard, it is enforced on every integration channel without a redeploy.
Built-in detection covers the attack classes every deployment shares; a custom policy covers the ones only yours has: an internal hostname that must never appear in a prompt, a table an agent may read but never drop, a phrase a support agent may not promise. In Shrike a rule is tested against a sample before it can block, propagates to every channel within about a minute, and every hit lands on the same evidence record as the built-in layers. The operator writes the rule; the governance layer enforces it wherever the agent acts.
Related
Shrike governs AI agent actions in real time: every command, query, and tool call evaluated against policy before it executes. Start with what is action governance or the quickstart.