Allow a new AI provider

When the deny_unknown_host rule blocks a new destination — say, api.deepseek.com — and you've decided it's OK to allow, the smallest rule that whitelists it goes above the deny:

yaml

- name: allow_deepseek
  description: "Approved AI provider — added 2026-05-16 after review."
  match:
    action: http_request
    destination: "*.deepseek.com"
  action: allow

# ... your existing rules ...

- name: deny_unknown_host
  match: { action: http_request }
  action: deny
  reason: "host not in allowlist"

After saving, check Live Traffic filtered to that destination: the calls that were denied should now show ALLOW with your rule's name in the Rule column.

If you'd rather get a per-call human approval instead of blanket allow, use action: require_approval instead.

→ See Writing policy rules.

Allow a new AI provider ​

Allow a new AI provider