A Knowledge policy governs indexed knowledge content. It bundles Knowledge controls — the guardrails that scan document content — and decides which knowledge sources those controls apply to.

What a Knowledge policy governs

When you create a policy and choose the Knowledge type, it governs indexed knowledge content — the material scanned as it's added to the search index. Only Knowledge controls can be added to a Knowledge policy; the control picker filters out anything built for Chat.

Choosing knowledge sources

A Knowledge policy's audience is defined under Knowledge sources — which knowledge sources this policy governs. Use Choose specific sources to add knowledge sources by name, hand-picking the ones the controls should scan. This lets you apply stricter checks to a single sensitive source — an HR drive or a legal repository, for example — without scanning everything else the same way. Picking sources this way is the only way to scope a Knowledge policy.

Adding controls

Add controls to the policy with Add controls, which shows only Knowledge controls. Every control you add scans the policy's sources together whenever content is indexed — for example, a PII check alongside a credentials-and-secrets check on the same source.

Reviewing what it catches

Open the policy's Incidents tab to see what its controls have restricted or flagged in the sources it covers. Use this to confirm the policy is catching sensitive content without over-restricting material users legitimately need.