Allow a new AI provider

When the deny_unknown_host rule blocks a new destination — say, api.deepseek.com — and you've decided it's OK to allow, the smallest rule that whitelists it goes above the deny:

yaml

- name: allow_deepseek
  description: "Approved AI provider — added 2026-05-16 after review."
  match:
    action: http_request
    destination: "*.deepseek.com"
  action: allow

# ... your existing rules ...

- name: deny_unknown_host
  match: { action: http_request }
  action: deny
  reason: "host not in allowlist"

Test the order with the Simulator before saving — it'll replay the last 24h of denied traffic through your draft and show you the new verdict for each.

If you'd rather get a per-call human approval instead of blanket allow, use action: require_approval instead.

→ See Writing policy rules, Simulator.

Allow a new AI provider ​

Allow a new AI provider