---
sourceDocument: Brazil Build or modify applications
sourceDocumentLink: https://www.servicenow.com/docs/r/application-development

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Build or modify applications

ft:clusterId :

    - cadev

bundleId :

    - cadev

workflow :

    - Development, Data, and Analytics


---

# Policy components in ServiceNow Arc

# Policy components in ServiceNow Arc {#ariaid-title1}

Release version: Brazil  
Updated September 29, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
A ServiceNow Arc policy has seven components, each controlling a different part of what the agent can do.

Each component is a separate record that you link to a policy from its tab on the policy record.

## Default policy components {#policy-components-cowork__default-components}

Every instance includes the Default Policy. It's active, applies to all users, and has values for all seven components.
{#policy-components-cowork__table-policy-components__entry__4}

| Component | Tab | Table | What it controls |
|-|-|-|-|
| Tool gates | Policy Tool Gates | sn_app_cowork_tool_gate | Sets each tool to Allow, Deny, HITL, or Auto. |
| Approval patterns | Policy Patterns | sn_app_cowork_approval_pattern | Defines which commands need a human decision, and whether the decision can be remembered (soft gate) or must be made every time (hard gate). |
| Network rules | Policy Network Rules | sn_app_cowork_network_rule | Lists the hosts and ports the sandbox can reach. Anything not on the allowlist is unreachable. |
| Sandbox rules | Policy Sandbox Rules | sn_app_cowork_sandbox_rule | Sets the sandbox filesystem boundary and network permissions for individual binaries. Rules can restrict access further but can't loosen the built in protection of credential paths and system directories. |
| File type rules | Policy File Type Rules | sn_app_cowork_file_type_rule | Sets read, write, or deny access for each file extension. |
| Connector scopes | Policy Connector Scopes | sn_app_cowork_connector_scope | Turns OAuth scopes on or off for each connector. Microsoft 365 is supported. By default, read scopes are on and send and write scopes are off. To require user approval before the action runs, select Approval gate on the linked scope. New write scopes require approval by default. |
| Capabilities | Capability Overrides | sn_app_cowork_capability, sn_app_cowork_capability_override | Feature switches and numeric limits, such as subagents, auto approval, the feedback URL, and MCP override. Overrides change a capability's value for the users a policy covers. |
[Table 1. Policy components]

{#policy-components-cowork__table-policy-components}

For how each tool gate setting handles an action, see [Action approval flow in ServiceNow Arc](https://www.servicenow.com/docs/Zcy2cpbqkxC20lVYjaRsgA "Tool gates, approval patterns, and auto approval determine whether each action in Arc runs, requires approval, or is blocked.").