Skip to content
StrikeUp Help Centre
Release notes

Plan and simulate tool policies

For: Account owners and administrators who plan which tools the assistant offers in different set-upsRequires: The Admin role to create, change and simulate policies; no plan or add-onScreenshots show sample data

One widget often serves customers who should see different parts of your product: a free plan that can only look up invoices, a paid plan that can also issue refunds. Tool access policies let you describe those sets of tools under a short key, and the simulation shows exactly which tools the assistant gets on a widget for any combination of keys. This guide covers what a policy is, how StrikeUp builds a session’s tool list from it, every setting, and the limits you need to know before you rely on it.

What it does

Section titled “What it does”

The assistant can call every active tool of the toolkits linked to a widget. When different customers should see different tools, you need a way to name each set and to check what a given combination produces before customers meet it.

A tool access policy is a name, a key and a set of tools. A chat session that carries one or more policy keys is offered only the tools mapped to those keys; a session without keys is offered every active tool of the widget’s toolkits. From there:

Policies restrict customers your backend signs in. Only your own backend gives a customer policy keys, in the one-time login ticket it signs the customer in with; the page that embeds the widget cannot set or change them. Customers who sign in any other way carry no keys and are offered every active tool. So keep switched-off tools, approvals and the permission checks in your own API, also as a second line of defence.

StrikeUp shows no record of which keys a session carried. To check a policy, use the simulation, which applies the same rule as live chats.

Before you start

Section titled “Before you start”
RequirementDetails
Plan or add-onNone. Every workspace has SecurityTool Policies.
RoleThe Admin role to create, change and delete policies and to run the simulation. Other members can view the policy list.
Toolkits with active toolsPolicies are built from tools switched on at ConfigureToolkits. Switched-off tools are never offered.
A widget linked to toolkitsThe simulation and live sessions use the toolkits linked to the widget.
CostNone. Policies and the simulation use no AI and count towards no quota.

Understanding policy keys

Section titled “Understanding policy keys”

A session’s tool list is built from the widget’s toolkits and the keys the session carries:

Keys the session carriesTools the assistant gets from the widget’s toolkitsExample on Demo Ltd’s support chat
NoneEvery active tool34 tools
One keyThe active tools mapped to that keyview_invoices: listInvoices, getInvoice, resendInvoice, exportInvoicesCsv
Several keysEvery active tool mapped to any of themview_invoices and manage_subscriptions: 9 tools
A key that matches no mapped toolNoneview_invoice (typo) or a key from another toolkit’s policy: 0 tools
The key of an inactive policyNoneread_only while inactive: 0 tools

How StrikeUp decides

Section titled “How StrikeUp decides”
  • Keys come from your backend. A session carries the keys your backend listed in the customer’s login ticket. Customers who sign in any other way carry none.
  • No keys means no narrowing. A session without keys, or with an empty list, gets every active tool of the widget’s toolkits.
  • Keys add up. With several keys, a tool is offered if it is mapped to any of them. A tool mapped to two keys appears once.
  • Keys match exactly. Upper and lower case count, so View_Invoices does not match view_invoices. Keys can only be created in lower case.
  • Only active tools. A tool switched off on the Toolkits page is never offered, whatever the policies say.
  • Only active policies grant. A key whose policy is Inactive, deleted or unknown grants nothing. Setting a policy back to Active restores its tools.
  • Changes reach open chats. A change to a policy’s key, status or tools applies from the customer’s next message, also in chats that are already open. New keys from a login ticket reach the customer’s chats the next time the widget connects.
  • Tool names must be unique on a widget. If two of a widget’s toolkits have a tool with the same name, the tool list cannot be built and the chat turn fails.

What policies do not affect

Section titled “What policies do not affect”
  • StrikeUp’s built-in notification tools, which a session can get regardless of keys.
  • Guardrails, data masking and the knowledge base. Masking still applies to the responses of whatever tools remain, and approval still applies to tools marked Requires User Approval.
  • Sessions started by workflows and autonomous agents. They carry no keys, so they get every active tool.
  • Conversations that already happened.

Setting it up in four steps

Section titled “Setting it up in four steps”

  1. Open the policy list. Go to SecurityTool Policies. The page shows every policy with the tools it grants.

    StrikeUp with the "Security" section of the left sidebar expanded, listing "Guardrails", "Data masking" and the highlighted "Tool Policies" entry, which opens the Tool Access Policies page shown on the right. That page lists five policies, View invoices, Issue refunds, Manage subscriptions, Billing admin and Read-only access, each with the tools it grants as blue badges, and offers "Refresh", "Tool Access Simulation" and "Create Policy" at the top right.StrikeUp with the "Security" section of the left sidebar expanded, listing "Guardrails", "Data masking" and the highlighted "Tool Policies" entry, which opens the Tool Access Policies page shown on the right. That page lists five policies, View invoices, Issue refunds, Manage subscriptions, Billing admin and Read-only access, each with the tools it grants as blue badges, and offers "Refresh", "Tool Access Simulation" and "Create Policy" at the top right.
    Tool access policies live under Security › Tool Policies.
    What this screenshot shows
    Screen
    Tool Policies (/admin/feature-flags)
    Highlighted
    “”, sidebar-security-group, current page. opens the Tool Access Policies list
    Also visible
    Security group expanded: Guardrails, Data masking, Tool Policies; Policy list with five policies
    Purpose
    entry point of the feature

  2. Create one policy per building block. Select Create Policy, enter a name and a key such as view_invoices, choose a toolkit, tick the tools and select Create Flag. Small policies, such as “View invoices” and “Issue refunds”, combine more easily than one policy per plan.

  3. Check each policy in the simulation. Select Tool Access Simulation, choose the widget, and tick the policy. Available Tools shows exactly what a session with that key gets.

  4. Compare your tiers (optional). Switch to Compare, set up both tiers as scenarios, and select Compare Results to see what the higher tier adds.

Then give customers their keys. Your backend lists each customer’s policy keys when it signs the customer in with a one-time login ticket. Until it does, customers are offered every active tool.

Every setting, explained

Section titled “Every setting, explained”

A policy has six settings. The create dialog Create Feature Flag asks for the first five; status and further toolkits are set in the edit dialog Edit Feature Flag.

Name, how your team recognises the policy

Section titled “Name, how your team recognises the policy”
Where
The Name field in both dialogs.
What
Required; Name is required otherwise. Up to 255 characters. It is the only text shown in the policy list and in the simulation, and the list search looks at it.
Why
Lets everyone on your team find the right policy at a glance.

Key, the identifier a session carries

Section titled “Key, the identifier a session carries”
Where
The Key field in both dialogs. The policy list does not show it; open the edit dialog to read it.
What
Required; Key is required otherwise. Lower-case letters, digits and underscores only; capitals turn into lower case and spaces into underscores as you type, and anything else is refused with Key must contain only lowercase letters, numbers, and underscores. Unique in your workspace, including inactive policies; a second policy with the same key is refused with “A flag with key ’…’ already exists”. The key is not derived from the name. If you change it later, the policy keeps its tools under the new key, but customers whose login ticket still lists the old key get none of them until your backend sends the new key.
Why
The key is what a session is matched against, so it must be short, exact and stable.
The "Create Feature Flag" dialog after "Create Flag" was pressed with the key export-invoices. The "Key" field is marked red and the highlighted message below it reads "Key must contain only lowercase letters, numbers, and underscores". Name, description, toolkit and the two ticked tools are unchanged. Nothing was saved; replacing the hyphen with an underscore makes the key valid.The "Create Feature Flag" dialog after "Create Flag" was pressed with the key export-invoices. The "Key" field is marked red and the highlighted message below it reads "Key must contain only lowercase letters, numbers, and underscores". Name, description, toolkit and the two ticked tools are unchanged. Nothing was saved; replacing the hyphen with an underscore makes the key valid.
Hyphens, spaces and capitals are not allowed in a key; the form says so before anything is saved.
What this screenshot shows
Screen
Create Feature Flag (/admin/feature-flags)
Highlighted
“”, dialog-key-field-error, shown after Create Flag. blocks saving until the key is valid
Also visible
Key export-invoices marked invalid
Purpose
validation error for a key with a hyphen
DoDon’t
Name what the key grants: view_invoices, issue_refundsUse hyphens or capitals: View-Invoices
Keep one key per building blockPut plan names in keys you may rename later
Change a key here and in your backend at the same timeRename a key while your backend still sends the old one

Description, the note for your team

Section titled “Description, the note for your team”
Where
The Description field in both dialogs.
What
Optional, up to 1,000 characters. Shown only in the edit dialog.
Why
Records why the policy exists, such as “Lets customers on the Growth plan list and export their invoices.”

Toolkit, where the tools come from

Section titled “Toolkit, where the tools come from”
Where
Toolkit in the create dialog; Toolkit (Optional) in the edit dialog.
What
Required when creating; Toolkit is required otherwise. One toolkit per dialog. The edit dialog opens on the first toolkit the policy has tools in; choose another toolkit there to add its tools.
Why
Tools are listed per toolkit so the checklist stays short.

Tools, what the policy grants

Section titled “Tools, what the policy grants”
Where
Tools in the create dialog; Tools (Optional) in the edit dialog. Select All and Deselect All sit above the checklist.
What
Lists the active tools of the chosen toolkit with their descriptions. Creating needs at least one tool; Please select at least one tool otherwise, and No active tools found for this toolkit when the toolkit has none. In the edit dialog the checklist opens with no box ticked, even for tools the policy already grants: tick every tool the policy should keep before you select Save Changes, because unticked tools of that toolkit are removed. The dialog removes only tools of the toolkit selected in it.
Why
The tool set is the whole point of the policy.
The "Create Feature Flag" dialog filled in: "Name" Export invoices, "Key" export_invoices, a description about customers on the Growth plan, and "Toolkit" Demo Billing API. Under "Tools" the highlighted counter reads "2 of 18 tool(s) selected" next to "Select All" and "Deselect All"; listInvoices and exportInvoicesCsv are ticked in the checklist, which shows each active tool of the toolkit with its description. "Create Flag" at the bottom saves the policy with these two tools.The "Create Feature Flag" dialog filled in: "Name" Export invoices, "Key" export_invoices, a description about customers on the Growth plan, and "Toolkit" Demo Billing API. Under "Tools" the highlighted counter reads "2 of 18 tool(s) selected" next to "Select All" and "Deselect All"; listInvoices and exportInvoicesCsv are ticked in the checklist, which shows each active tool of the toolkit with its description. "Create Flag" at the bottom saves the policy with these two tools.
Tick the tools this policy grants; only active tools of the chosen toolkit are offered.
What this screenshot shows
Screen
Create Feature Flag (/admin/feature-flags)
Highlighted
“”, dialog-tools-header, 2 of 18 selected. counts the ticked tools
Also visible
Name Export invoices, key export_invoices, toolkit Demo Billing API; listInvoices and exportInvoicesCsv ticked
Purpose
choose the tools a policy grants

Status, whether the policy grants its tools

Section titled “Status, whether the policy grants its tools”
Where
The Status switch in the edit dialog, saved with Save Changes. New policies are Active.
What
Inactive stops the policy from granting tools: a session that carries its key gets none of its tools from the next message on, and the policy is hidden from Tool Access Simulation. The tools stay attached, so setting it back to Active restores them.
Why
Pauses a policy without losing its tools.
The "Edit Feature Flag" dialog for "Read-only access", with key read_only. The highlighted "Status" switch is set to Inactive. An inactive policy disappears from the Tool Access Simulation pickers but, today, a session that sends its key still receives its tools. Below are "Toolkit (Optional)", "Tools (Optional)" with the tool checklist, a "Warning:" box about changing the key, and "Cancel" and "Save Changes".The "Edit Feature Flag" dialog for "Read-only access", with key read_only. The highlighted "Status" switch is set to Inactive. An inactive policy disappears from the Tool Access Simulation pickers but, today, a session that sends its key still receives its tools. Below are "Toolkit (Optional)", "Tools (Optional)" with the tool checklist, a "Warning:" box about changing the key, and "Cancel" and "Save Changes".
Status Inactive hides a policy from the simulation, but does not stop sessions that send its key from getting its tools.
What this screenshot shows
Screen
Edit Feature Flag (/admin/feature-flags)
Highlighted
switch “Status”, dialog-status, Inactive. switches the policy between Active and Inactive
Also visible
Name Read-only access, key read_only; Warning box about key changes
Purpose
what the status switch does (and does not) do

How the settings combine

Section titled “How the settings combine”
Tools mappedStatusA session carrying the key getsAppears in the simulation
SomeActiveThe mapped tools that are activeYes
SomeInactiveNothing from the widget’s toolkitsNo
NoneEitherNothing from the widget’s toolkitsOnly when active
Mapped, but all switched off on the Toolkits pageEitherNothing from the widget’s toolkitsOnly when active

Tool policies on the policy list

Section titled “Tool policies on the policy list”
Section titled “The list and its search”

The policy list shows each policy’s name and up to five of its tools as badges, then +{{count}} more.... Tools from all toolkits are shown together. The search box filters by name only, as you type.

Why: the list is where you see at a glance which tools each policy grants, without opening it.

The Tool Access Policies page with "billing" typed into the highlighted "Search by name..." box. The table now shows a single policy, "Billing admin", with its tools listInvoices, getInvoice, createCreditNote, changeSubscriptionPlan, pauseSubscription and "+3 more...", plus edit and delete icons. The search matches policy names only, not keys or tool names, and filters the list as you type.The Tool Access Policies page with "billing" typed into the highlighted "Search by name..." box. The table now shows a single policy, "Billing admin", with its tools listInvoices, getInvoice, createCreditNote, changeSubscriptionPlan, pauseSubscription and "+3 more...", plus edit and delete icons. The search matches policy names only, not keys or tool names, and filters the list as you type.
Search filters policies by name while you type; it does not look at keys or tools.
What this screenshot shows
Screen
Tool Access Policies (/admin/feature-flags)
Highlighted
textbox “Search by name...”, above-table-left, contains "billing". filters the list by policy name
Also visible
One result: Billing admin with 5 tool badges and +3 more
Purpose
find a policy in a long list

Deleting a policy

Section titled “Deleting a policy”

A policy that still has tools cannot be deleted. StrikeUp refuses with “Error deleting flag” and “Cannot delete flag ‘key’ because it is assigned to N tool(s). Remove the tool mappings first.” Open the policy, leave every tool unticked, save, then delete it.

Why: deleting cannot be undone, so the policy must be emptied deliberately first.

The Tool Access Policies page after trying to delete "Read-only access". The delete confirmation is still open in the middle, and at the top right two error notices appear: the highlighted "Error deleting flag" and "Request failed", both with the text "Cannot delete flag 'read_only' because it is assigned to 4 tool(s). Remove the tool mappings first." The policy stays in the list until its tools are unticked in Edit and saved.The Tool Access Policies page after trying to delete "Read-only access". The delete confirmation is still open in the middle, and at the top right two error notices appear: the highlighted "Error deleting flag" and "Request failed", both with the text "Cannot delete flag 'read_only' because it is assigned to 4 tool(s). Remove the tool mappings first." The policy stays in the list until its tools are unticked in Edit and saved.
A policy with tools cannot be deleted; untick its tools in Edit and save first.
What this screenshot shows
Screen
Delete Access Policy (/admin/feature-flags)
Highlighted
“”, toast-top-right, error toast. explains why the delete was refused
Also visible
Request failed toast and Error deleting flag toast; Delete Access Policy dialog still open
Purpose
troubleshooting a refused delete

Tool policies in the simulation

Section titled “Tool policies in the simulation”
Where
SecurityTool Policies, the Tool Access Simulation button in the header. The page has no sidebar entry; its heading is Tool Access Preview.
What
In Preview mode, choose a widget and tick active policies; the tool list updates at once. In Compare mode, set up two scenarios and compare them. The simulation uses the same rule as live sessions, minus StrikeUp’s built-in notification tools. Running it needs the Admin role.
Why
It is the only place that shows exactly what a set of keys grants on a widget.
The Tool Access Policies page: the title "Tool Access Policies" with its subtitle, the search box, and on the right "Refresh", the highlighted "Tool Access Simulation" button with an eye icon and "Create Policy". The five policy rows, from View invoices to Read-only access, are listed below. "Tool Access Simulation" opens the Tool Access Preview page, which has no entry of its own in the sidebar.The Tool Access Policies page: the title "Tool Access Policies" with its subtitle, the search box, and on the right "Refresh", the highlighted "Tool Access Simulation" button with an eye icon and "Create Policy". The five policy rows, from View invoices to Read-only access, are listed below. "Tool Access Simulation" opens the Tool Access Preview page, which has no entry of its own in the sidebar.
Open the simulation from the policy list; it has no sidebar entry of its own.
What this screenshot shows
Screen
Tool Access Policies (/admin/feature-flags)
Highlighted
button “Tool Access Simulation”, header-right, enabled. opens /admin/feature-flags/preview
Also visible
Refresh and Create Policy buttons beside it
Purpose
entry point of the simulation

Three ways to use it:

  • Check the default. No policy ticked shows what a session without keys gets: every active tool.

    The Tool Access Preview page in Preview mode with "Widget" set to Demo Ltd Support chat and no box ticked under "Access Policies". The "Available Tools" panel carries the highlighted badge "34 tools": with no policy key, a session gets every active tool of the widget's two toolkits, Demo Billing API and Demo Accounts API. The list starts with listInvoices, getInvoice, resendInvoice, voidInvoice and exportInvoicesCsv and scrolls for the rest.The Tool Access Preview page in Preview mode with "Widget" set to Demo Ltd Support chat and no box ticked under "Access Policies". The "Available Tools" panel carries the highlighted badge "34 tools": with no policy key, a session gets every active tool of the widget's two toolkits, Demo Billing API and Demo Accounts API. The list starts with listInvoices, getInvoice, resendInvoice, voidInvoice and exportInvoicesCsv and scrolls for the rest.
    No policy means no restriction; the session gets every active tool of the widget's toolkits.
    What this screenshot shows
    Screen
    Tool Access Preview (/admin/feature-flags/preview)
    Highlighted
    “”, available-tools-header, 34 tools. counts the tools a session without keys gets
    Also visible
    Widget Demo Ltd Support chat, no policy ticked
    Purpose
    the default without policy keys

  • Check one policy. Ticking View invoices on the support chat narrows the list to 4 tools.

    The same Tool Access Preview with the highlighted "View invoices" box now ticked under "Access Policies" for the Demo Ltd Support chat widget. "Available Tools" drops to the badge "4 tools" and lists listInvoices, getInvoice, resendInvoice and exportInvoicesCsv with their descriptions. A session that carries the key view_invoices gets exactly these four tools; ticking more policies adds their tools to the list.The same Tool Access Preview with the highlighted "View invoices" box now ticked under "Access Policies" for the Demo Ltd Support chat widget. "Available Tools" drops to the badge "4 tools" and lists listInvoices, getInvoice, resendInvoice and exportInvoicesCsv with their descriptions. A session that carries the key view_invoices gets exactly these four tools; ticking more policies adds their tools to the list.
    With one policy the session gets only that policy's tools; several policies add up.
    What this screenshot shows
    Screen
    Tool Access Preview (/admin/feature-flags/preview)
    Highlighted
    “”, left-panel-policies, ticked. simulates a session carrying the key view_invoices
    Also visible
    Available Tools: 4 tools
    Purpose
    how one policy narrows the tool list

  • Compare two tiers. One scenario with View invoices and another with Issue refunds and Manage subscriptions show which tools only the higher tier gets.

    The Tool Access Preview in Compare mode, used like two plan tiers. "Scenario A" is the Demo Ltd Help Centre widget with View invoices; "Scenario B" is the Demo Ltd Support chat with Issue refunds and Manage subscriptions. After "Compare Results", the highlighted column "Unique to Scenario B" lists six tools only B gets, such as createCreditNote, changeSubscriptionPlan and updateBillingAddress, next to "In Both Scenarios" (getInvoice) and "Unique to Scenario A" (exportInvoicesCsv, listInvoices, resendInvoice).The Tool Access Preview in Compare mode, used like two plan tiers. "Scenario A" is the Demo Ltd Help Centre widget with View invoices; "Scenario B" is the Demo Ltd Support chat with Issue refunds and Manage subscriptions. After "Compare Results", the highlighted column "Unique to Scenario B" lists six tools only B gets, such as createCreditNote, changeSubscriptionPlan and updateBillingAddress, next to "In Both Scenarios" (getInvoice) and "Unique to Scenario A" (exportInvoicesCsv, listInvoices, resendInvoice).
    Compare two set-ups side by side to check what an upgrade adds before your customers see it.
    What this screenshot shows
    Screen
    Tool Access Preview (/admin/feature-flags/preview)
    Highlighted
    “”, results-right-column, 6 tools. lists tools only scenario B gets
    Also visible
    Scenario A and B widget selects with ticked policies (labelled Feature Flags in this mode); Three result columns: 3 / 1 / 6 tools
    Purpose
    plan-tier comparison

What you need to know

Section titled “What you need to know”
TopicFact
Ticket sign-ins onlyPolicies restrict customers your backend signs in with a login ticket that lists policy keys. Everyone else is offered every active tool.
Keys come from your backendOnly the login ticket gives a customer keys. The page that embeds the widget cannot set or change them.
No keys, every toolA session without keys gets every active tool of the widget’s toolkits.
Keys add upSeveral keys give every tool mapped to any of them.
Exact matchKeys are case-sensitive and must match exactly.
Inactive grants nothingAn inactive policy gives no tools and is hidden from the simulation. Its tools stay attached.
Changes reach open chatsA change to a policy’s key, status or tools applies from the next message.
Renaming a keyThe tools move to the new key. Customers get them once your backend sends the new key.
EditingThe edit dialog opens with no tool ticked; tick the tools to keep before saving. It shows and removes one toolkit’s tools at a time.
DeletingRefused while tools are mapped. Deleting a toolkit or tool removes it from every policy.
Workflows and autonomous agentsThey carry no keys and get every active tool.
No usage viewStrikeUp shows no record of which keys a session carried.
LanguagesKeys are identifiers and work in every language. Several notices on these screens are shown in English.
CostNone.

Frequently asked questions

Section titled “Frequently asked questions”

General

Section titled “General”

What is a tool access policy?

Section titled “What is a tool access policy?”

It is a name, a key and a set of tools on SecurityTool Policies. A chat session that carries the key is offered the policy’s tools; a session without keys is offered every active tool of the widget’s toolkits. Several keys add up.

Can I use tool policies to stop a customer from using a tool?

Section titled “Can I use tool policies to stop a customer from using a tool?”

For customers your backend signs in with a login ticket that lists policy keys, yes: they are offered only the tools of those policies. Customers who sign in any other way are offered every active tool. To keep a tool from them, and as a second line of defence for everyone, switch it off on ConfigureToolkits, mark it Requires User Approval, and let your API refuse what the customer may not do.

How does a session get policy keys?

Section titled “How does a session get policy keys?”

Your backend lists them when it signs the customer in with a one-time login ticket. Every chat of that customer then carries them, and each new ticket replaces them; a ticket without keys lifts the restriction. The page that embeds the widget cannot set or change keys.

What happens when a session carries no policy key?

Section titled “What happens when a session carries no policy key?”

It gets every active tool of the widget’s toolkits, exactly as if no policies existed. You can see this list in Tool Access Simulation by choosing the widget and ticking no policy.

Do tool policies cost anything?

Section titled “Do tool policies cost anything?”

No. Creating policies and running the simulation use no AI and count towards no quota or budget. The tools the assistant then calls cost what they always cost; policies only decide which tools are offered.

Do policies change what the assistant knows or says?

Section titled “Do policies change what the assistant knows or says?”

No. Policies only decide which of your API tools the assistant can choose from. The knowledge base, guardrails on SecurityGuardrails and data masking work exactly the same with or without keys.

Setup

Section titled “Setup”

Who can create and change policies?

Section titled “Who can create and change policies?”

Members with the Admin role. Other members can open SecurityTool Policies and read the list, but creating, saving and deleting fail with Request failed. Running the simulation also needs the Admin role.

Which tools can I add to a policy?

Section titled “Which tools can I add to a policy?”

The active tools of your toolkits. The create dialog lists the active tools of the toolkit you choose; switch tools on at ConfigureToolkits first if the list shows No active tools found for this toolkit.

Can one policy include tools from two toolkits?

Section titled “Can one policy include tools from two toolkits?”

Yes. Create it with tools from one toolkit, then open it with the pencil icon, choose the second toolkit in Toolkit (Optional), tick its tools and save. The edit dialog opens on the first toolkit and removes only tools of the toolkit selected in it.

Why did my policy lose its tools after I edited it?

Section titled “Why did my policy lose its tools after I edited it?”

The tool checklist in Edit Feature Flag opens with no box ticked, and saving removes every unticked tool of that toolkit. Open the policy again, tick the tools it should grant, and select Save Changes.

What rules apply to a key?

Section titled “What rules apply to a key?”

Lower-case letters, digits and underscores only, unique in your workspace, inactive policies included. Capitals become lower case and spaces become underscores while you type; hyphens are refused with Key must contain only lowercase letters, numbers, and underscores.

Can I rename a key?

Section titled “Can I rename a key?”

Yes. The policy keeps its tools under the new key. Customers whose login ticket still lists the old key get none of them until your backend sends the new key, so change it there at the same time.

Keys and combinations

Section titled “Keys and combinations”

Two keys in one session: do I get the tools both share, or all of them?

Section titled “Two keys in one session: do I get the tools both share, or all of them?”

All of them. A session with several keys is offered every tool mapped to any of its keys, and a tool shared by two policies appears once. Build tiers by combining small policies, such as View invoices plus Issue refunds.

Are keys case-sensitive?

Section titled “Are keys case-sensitive?”

Yes, but they are always lower case: policies can only be created that way, and a login ticket with a capital letter in a key is refused. A session’s keys must match a policy key exactly, so view_invoice does not match view_invoices and grants no tools.

What happens if a key matches no policy?

Section titled “What happens if a key matches no policy?”

The session gets no tools from the widget’s toolkits; the assistant can only answer from its knowledge. The same happens for a key whose policy is inactive or has no tools on that widget’s toolkits, and for the old key of a renamed policy.

Does setting a policy to inactive switch it off?

Section titled “Does setting a policy to inactive switch it off?”

Yes. A policy set to Inactive grants no tools from the next message on, also in open chats, and is hidden from Tool Access Simulation. Its tools stay attached, so setting it back to Active restores them.

Do workflows and autonomous agents use tool policies?

Section titled “Do workflows and autonomous agents use tool policies?”

No. Sessions started by workflows and autonomous agents carry no policy keys, so they are offered every active tool of their toolkits. Control their tools by switching tools on and off on ConfigureToolkits.

Where it is shown

Section titled “Where it is shown”

When does a policy change reach an open chat?

Section titled “When does a policy change reach an open chat?”

With the customer’s next message. A change to a policy’s key, status or tools also applies to chats that are already open; the simulation always shows the current state.

Can I see which keys a session used?

Section titled “Can I see which keys a session used?”

No. StrikeUp does not show which policy keys a chat session carried. Use Tool Access Simulation to see what a given set of keys grants on a widget.

Simulation

Section titled “Simulation”

Why does the simulation list fewer tools than a customer’s chat shows?

Section titled “Why does the simulation list fewer tools than a customer’s chat shows?”

A live session can also get StrikeUp’s built-in notification tools, which do not depend on policies and are not listed in Tool Access Preview.

Why is a policy missing from the simulation?

Section titled “Why is a policy missing from the simulation?”

The simulation lists active policies only. Set the policy’s Status to Active in the edit dialog on SecurityTool Policies to simulate it. While it is inactive, it also grants nothing in live chats.

What does “Duplicate tool names detected across servers” mean?

Section titled “What does “Duplicate tool names detected across servers” mean?”

Two toolkits linked to the widget have a tool with the same name, so StrikeUp cannot build a tool list for that widget, in the simulation or in a live chat. Rename one of the tools on ConfigureToolkits, or remove one toolkit from the widget.

Deleting

Section titled “Deleting”

What happens to my policies when I delete a toolkit or a tool?

Section titled “What happens to my policies when I delete a toolkit or a tool?”

The deleted toolkit’s or tool’s entries are removed from every policy automatically. A policy can end up with No tools on SecurityTool Policies; it stays in the list until you delete it.

Troubleshooting

Section titled “Troubleshooting”
SymptomWhat to check
A customer is offered every toolIn order: did the customer sign in with a login ticket from your backend? Only those customers carry keys. Does the ticket list the policy keys? A session without keys gets every active tool.
A customer is offered no tools from your APIIn order: does the key match exactly? Was the key renamed while your backend still sends the old one? Is the policy active? Does it have tools on the widget’s toolkits? Are those tools switched on?
A policy no longer grants its toolsIts status is Inactive. Set it back to Active in the edit dialog.
“Duplicate tool names detected across servers”Two of the widget’s toolkits share a tool name. Rename one tool or remove one toolkit from the widget.
“Error deleting flag” with “Cannot delete flag … because it is assigned to N tool(s)”Untick every tool in the edit dialog, save, then delete.
A policy lost its tools after an editThe checklist opened unticked and was saved. Tick the tools again and save.
Customers lost a policy’s tools after its key was changedYour backend still sends the old key. Send the new key in its login tickets.
Key must contain only lowercase letters, numbers, and underscoresUse lower-case letters, digits and underscores only.
The simulation fails with Request failedRunning it needs the Admin role.
Section titled “Related”