The four policy actions

Every rule in Sentilai resolves to one of four actions. They mean the same thing wherever they appear.

Allow

Nothing beyond the ordinary audit row. Use it to carve an exception out of a stricter default — for example, a default of Block with explicit Allow rules for the MCP servers you have approved.

Report

Recorded as a finding. Visible in Activity and counted in Compliance. Nothing is interrupted and the developer sees nothing.

This is the setting you want while you are learning. It gives you the same visibility as blocking without changing anyone's day. Most organizations should spend their first weeks almost entirely in Report.

Warn

Recorded more prominently and, where the path allows it, surfaced to the developer. Useful when you want the person to know without stopping them — a nudge, not a wall.

Block

The request or tool call does not proceed. In Activity the row is tinted with a red rail and its outcome is Blocked.

How they combine

• MCP rules: the most specific rule wins — tool, then server, then pending, then default.
• Across servers in one request: the most restrictive wins. The Gateway cannot partially block a single API call.
• Detectors: independent of MCP rules; the strongest action any detector takes determines the outcome.