Policies

The Policies page helps you identify API and MCP assets that violate security or compliance requirements. Traceable provides predefined policies for OWASP API Top 10, OWASP LLM Top 10, OWASP MCP Top 10, and PCI DSS. You can also define your own policies to detect violations based on attributes, such as vulnerability type, data sensitivity, and endpoint behavior, and enable or disable any policy according to your requirements.

What you will learn from this topic

By the end of this topic, you will be able to:

• Understand how Traceable uses policies to identify security and compliance violations across API and MCP assets.

• Understand how policies are organized across the API, MCP, and Custom tabs.

• Review policy details, including framework references, severity, environments, and status.

• Configure predefined policies by defining their scope, detection conditions, and severity.

• Create and manage custom policies.

• Review policy violations and identify the corresponding issues on the Issues page.

Understand policies

Traceable evaluates every policy against your API and MCP traffic and lists the resulting violations as issues. The following table provides an overview of policies, including their purpose, how they work, and how you can use them in Traceable:

Policy categorization

Traceable groups every policy by the type of asset it protects, rather than by the framework it belongs to. This allows a single policy to map to multiple frameworks, for example, PCI DSS and OWASP API Top 10, without being duplicated or hidden under the wrong tab. The following table discusses the tabs and how they differ:

For more information, see Policy view and Configure policies.

Policy view

The Policy view provides a centralized overview of all policies, including their framework mappings, severity, applicable environments, status, and available actions, helping you understand and manage each policy’s configuration and application.

Traceable shows the following information for each tab mentioned above:

Filters

Use multi-select filters on each tab to narrow the policy list based on your requirements. Traceable applies AND logic across filter categories and OR logic within a category. This lets you combine multiple criteria to answer specific coverage questions, such as identifying disabled, high-severity policies that protect MCP Tools.

Each tab provides the following filters:

Each tab also includes framework chips relevant to that asset type. Select a framework chip to immediately filter the policy list to policies mapped to that framework.

• API — OWASP API Top 10, OWASP LLM Top 10, PCI-DSS

• MCP — OWASP MCP Top 10

Configure policies

Traceable provides you with the flexibility to rely on predefined policies, customize them, or define your own, according to your requirements. This section highlights the recommendations on when to use these options, along with the corresponding steps.

Recommendation

Traceable recommends using:

• Predefined policies under the API and MCP tabs when you want to get started quickly with Traceable-recommended coverage for OWASP and PCI DSS frameworks.

• Custom policies under the Custom tab when you want to detect a violation based on attributes or conditions according to your requirements.

System Policies

Custom policies

Traceable, by default, provides you with policies under the API and MCP tabs. Traceable recommends enabling these policies to help identify the most common violations of PCI DSS, OWASP API Top 10, OWASP LLM Top 10, and OWASP MCP Top 10 across your API and MCP assets.

Traceable also allows you to edit a policy configuration according to your requirements. To edit a configuration, click the Ellipsis (⋯) icon corresponding to a policy.

Edit a policy

To edit a policy configuration, click the Ellipsis (⋯) icon → Edit corresponding to a policy, and complete the following steps:

Step 1 — Scope

1. Select the Environment(s) where you wish to apply the policy, for example, All Environments.

2. (Optional) Enable the Advanced Settings toggle if you wish to use SPAN attributes for configuring the conditions below.

3. Define the policy scope by configuring the condition groups. You can add one or more condition groups according to your requirements:

   1. Select how Traceable should match the condition groups:

      • Match All — Traceable performs an AND operation between the condition groups, if selected.

      • Match Any — Traceable performs an OR operation between the condition groups, if selected.

   2. Click + Condition Group and complete the following steps:

      1. Select how Traceable should match the conditions: Match All or Match Any.

      2. Click + Add condition.

      3. Select or specify the Attribute for which you wish to apply the condition.

      4. Select the Operator corresponding to the attribute.

      5. Select or specify the Value(s) corresponding to the attribute and operator.

      6. (Optional) Click + corresponding to a condition to add more according to your requirements.

   3. (Optional) Repeat the above step to add more condition groups.

4. Click Next.

Step 2 — Parameters

Select the Attribute, and its corresponding Operator, and specify the Value based on which Traceable should detect issues for the policy. Further, click Next.

Note

The availability of the configurations in this step depends on the policy you are editing.

Step 3 — Severity Conditions

Select the Severity that Traceable should assign to the issues detected using the policy, and click Save.

You can create custom policies by selecting the attributes according to your requirements. Traceable uses these policies, identifies their corresponding violations, and lists them on the Issues page for you to take action.

Create a custom policy

To create a custom policy, navigate to the Custom tab, click + Custom Policy, and complete the following steps:

Step 1 — Scope

1. Specify the policy Name. Traceable uses this policy name as the Issue Name on the Issues page.

2. Specify a Description for the policy.

3. From the Environment drop-down list, select the environment(s) in which the policy should apply. By default, Traceable selects All Environments.

4. Define the policy Scope by configuring the condition groups. You can add one or more condition groups according to your requirements:

   1. Select how Traceable should match the condition groups:

      • Match All — Traceable performs an AND operation between the condition groups, if selected.

      • Match Any — Traceable performs an OR operation between the condition groups, if selected.

   2. Click + Condition Group and complete the following steps:

      1. Select how Traceable should match the conditions: Match All or Match Any.

      2. Click + Add condition.

      3. Select the Attribute for which you wish to apply the condition.

      4. Select the Operator corresponding to the attribute.

      5. Select the Value(s) corresponding to the attribute and operator.

      6. (Optional) Click + corresponding to a condition to add more according to your requirements.

   3. (Optional) Repeat the above step to add more condition groups.

5. Click Next.

Step 2 — Detection Conditions

1. In the API Attribute section, click + Add condition, then select the attribute based on your requirements. For example, Endpoint Name is equal to (=) GET /userinfo/json.

2. In the Vulnerability Attribute section, click + Add condition and select the attribute according to your requirements. For example, Vulnerability Status is (IN) either Open or Under review.

3. In the Datatypes section, click + Add condition and select the attributes according to your requirements. For example, Request & Response of the API endpoint contains either (Contains any of) the Credit Card PIN, username, and password data types.

4. In the Datasets section, click + Add condition and select the attributes according to your requirements. For example, the Response of the API endpoint does not contain either (Contains any of) the Generic Personal Info or PII UK data sets.

5. In the Data Sensitivity section, click + Add condition and select the attributes according to your requirements. For example, the Request data for an API endpoint is highly sensitive (High).

6. Click Next.

Note

Traceable carries out an AND operation between the conditions defined above.

Step 3 — Severity Conditions

Select the Severity that Traceable should assign to the issues detected using the policy, and click Submit.

List identified issues

While the Policies page lists the policies themselves, the violations they detect appear on the Issues page under Discovery → Issues. From there, you can review each violation and the API or MCP asset where Traceable identified it. For more information, see Issues Overview.

Note

The policies on this page only identify violations across discovered assets. To actively protect your APIs based on these findings, you can create policies under API Protection. For more information, see Custom Policy.

Manage custom policies

To manage a custom policy, click the Ellipsis (⋯) icon corresponding to a row. The following table explains the actions available for managing a custom policy: