---
title: Asset Policies
description: The catalog of policies Surface checks installed AI assets against, what each column means, and how policies are grouped and scored.
---

_[console.superalign.ai/policies/assets](https://console.superalign.ai/policies/assets)_

A **policy** is a condition Surface checks for, such as an MCP server with a password saved in plain text. When an asset meets the condition, the policy fails for that asset. SuperAlign writes and updates them, and scanners pick up new versions on their own. You can read them here but not switch them on or off yet.

The console splits the catalog in two, under **Policies** in the left menu:

| Page | Policies about | Example |
| --- | --- | --- |
| **Asset Policies** | Installed AI assets | An MCP server has a plain-text credential in its configuration |
| [Session Policies](/surface/policies/session-policies) | Recorded AI conversations | An AI tool signed in with an account outside the company domain |

Policies are not the same as actions. A policy finds a problem; an action (Allow, Warn, or Block) is what you decide to do about an asset. See [Asset Access](/surface/policies/asset-access).

## What the policies look at

When an installed asset breaks a policy, it shows as a **Failed Policy** on the asset and counts towards its [risk score](/surface/overview/risk-scoring). Examples:

- An MCP server has a plain-text credential in its configuration.
- A browser extension asks for access to every website.
- A hook pipes a remote download to a shell.

## The table

| Column | Meaning |
| --- | --- |
| **Framework** | The security frameworks the policy maps to |
| **Policy Name** | The policy's name and a one-line description |
| **Scope** | The kind of asset the policy applies to |
| **Tags** | Labels for filtering and reporting |
| **Violations** | How many asset instances currently break this policy |

Search by name or description, and filter by **Asset Type** and **Severity**. Click a policy to open its panel. **Details** shows the description, **Policy Type**, **Tags**, **Framework**, **Score**, **Severity**, and **Remediation** (how to fix it). **Violations** lists the assets breaking the policy, grouped by asset type, and each asset expands to show its endpoints.

Each policy carries:

- A **severity**: critical, high, medium, low, or info.
- A **score**, used in the [risk calculation](/surface/overview/risk-scoring).
- Where relevant, a **Framework** badge: OWASP ASI, OWASP LLM, MITRE ATLAS, or a CWE number (a public list of common software weaknesses).