# Policy Testing Guide

This guide helps you validate that Capsule policies are working correctly by running controlled test scenarios with your coding agents. Each scenario triggers a specific policy, so you can confirm your organization's security monitoring is functioning as expected.

## Overview

Capsule monitors coding agent sessions in real time, analyzing messages, tool invocations, and agent configuration against your defined policies. Policies define what to look for and how to respond when a violation is detected.

This guide provides ready-to-use test scenarios for each policy. Each scenario walks you through the exact steps to trigger a detection, what to expect in the portal, and how to verify the result.

**Important:** Some test scenarios involve prompts that reference destructive commands (such as file deletion, database drops, or infrastructure changes). Always run these tests in a sandbox or isolated test environment - never against production systems or agents with live credentials. Policies in Monitoring mode will log violations but will not block the action, so a destructive command could execute before the violation is recorded.

## Prerequisites

Before running test scenarios, make sure you have:

- A **sandbox or test environment** - do not run these scenarios against production systems or agents with live infrastructure credentials
- A **Capsule Security** account with access to the portal
- At least one coding agent integration deployed (for example, [Claude Code](/guides/claude-code) or [Cursor](/guides/cursor))
- At least one agent discovered in your Capsule portal (**Inventory > Agents**)
- Default policies enabled in **Monitoring** mode (enabled by default)


## How Policies Work

### Policy Types

Capsule has two kinds of policies:

| Type | Evaluates | Triggers on |
|  --- | --- | --- |
| Posture | Findings on a resource - an agent, MCP server, skill, tool, or data source | Configuration changes, such as a new MCP server, skill, instruction file, or setting |
| Runtime | Detections in an agent session | Session activity - user messages, agent messages and reasoning, or tool invocations |


### Combined Conditions

Some policies list more than one finding or detection type, for example **Prompt Injection with Intent Violation**. These policies trigger only when **all** listed types are present:

- **Posture policies** - every listed finding must be on the same resource
- **Runtime policies** - every listed detection must occur in the same session on the same agent


This is why combined policies carry a higher severity than their single-condition counterparts: the combination indicates a real attack chain, not an isolated signal.

### Policy Modes

Each policy operates in one of three modes that determine how it responds to a violation:

| Mode | Behavior |
|  --- | --- |
| Monitoring | Detects and logs violations with no user-facing action |
| Warning | Detects and alerts on violations |
| Prevention | Blocks the action in real time |


### What Happens When a Policy Triggers

When a policy triggers, Capsule takes the following actions:

- Creates a policy violation visible in the portal
- Blocks the action in real time (Prevention mode only)


Posture violations resolve automatically once the underlying finding is gone, for example after you remove a risky MCP server or fix an insecure setting.

## Out-of-the-Box Policies

All Capsule accounts come with pre-configured policies enabled in Monitoring mode. The tables below map each policy to the test scenario that validates it.

### Data Exposure Policies

| Policy Name | Severity | Trigger | Test Guide |
|  --- | --- | --- | --- |
| Credentials Exposure in Runtime | Medium | Session messages | [Test this policy →](/guides/policy-testing/data-leakage#credentials-exposure-in-runtime) |
| PII Exposure in Runtime | Medium | Session messages | [Test this policy →](/guides/policy-testing/data-leakage#pii-exposure-in-runtime) |
| PHI Exposure in Runtime | Medium | Session messages | [Test this policy →](/guides/policy-testing/data-leakage#phi-exposure-in-runtime) |
| PCI Exposure in Runtime | Medium | Session messages | [Test this policy →](/guides/policy-testing/data-leakage#pci-exposure-in-runtime) |
| PCI Exposure with Tool Invocation | High | Tool use | [Test this policy →](/guides/policy-testing/data-leakage#pci-exposure-in-runtime) |
| Business Intelligence Exposure in shared Agents | High | Session messages | [Test this policy →](/guides/policy-testing/data-leakage#business-intelligence-exposure-in-shared-agents) |


### Data Exposure in Public Agents

| Policy Name | Severity | Trigger | Test Guide |
|  --- | --- | --- | --- |
| Credentials Exposure in Public Agents | Critical | Session messages | [Test this policy →](/guides/policy-testing/data-leakage#data-exposure-in-public-agents) |
| PII Exposure in Public Agents | Critical | Session messages | [Test this policy →](/guides/policy-testing/data-leakage#data-exposure-in-public-agents) |
| PHI Exposure in Public Agents | Critical | Session messages | [Test this policy →](/guides/policy-testing/data-leakage#data-exposure-in-public-agents) |
| PCI Exposure in Public Agents | Critical | Session messages | [Test this policy →](/guides/policy-testing/data-leakage#data-exposure-in-public-agents) |


### Data Exfiltration via Tools

| Policy Name | Severity | Trigger | Test Guide |
|  --- | --- | --- | --- |
| Credentials Exposure with External Data Exposure via Tool | Critical | Tool use | [Test this policy →](/guides/policy-testing/dangerous-actions#data-exfiltration-via-tools) |
| PII Exposure with External Data Exposure via Tool | Critical | Tool use | [Test this policy →](/guides/policy-testing/dangerous-actions#data-exfiltration-via-tools) |
| PHI Exposure with External Data Exposure via Tool | Critical | Tool use | [Test this policy →](/guides/policy-testing/dangerous-actions#data-exfiltration-via-tools) |
| PCI Exposure with External Data Exposure via Tool | Critical | Tool use | [Test this policy →](/guides/policy-testing/dangerous-actions#data-exfiltration-via-tools) |


### Prompt Security Policies

| Policy Name | Severity | Trigger | Test Guide |
|  --- | --- | --- | --- |
| Prompt Injection with Intent Violation | Critical | Session messages | [Test this policy →](/guides/policy-testing/prompt-injection#prompt-injection-with-intent-violation) |
| Prompt Injection with Dangerous Actions | Critical | Session messages | [Test this policy →](/guides/policy-testing/prompt-injection#prompt-injection-with-dangerous-actions) |
| Prompt Injection Detected | High | Session messages | [Test this policy →](/guides/policy-testing/prompt-injection#prompt-injection-detected) |


### Operational Safety Policies

| Policy Name | Severity | Trigger | Test Guide |
|  --- | --- | --- | --- |
| Dangerous Actions with Intent Violation | High | Tool use | [Test this policy →](/guides/policy-testing/dangerous-actions#dangerous-actions-with-intent-violation) |
| Vulnerable Package Installation | High | Tool use | [Test this policy →](/guides/policy-testing/dangerous-actions#vulnerable-package-installation) |
| Reconnaissance Activity | Medium | Tool use | [Test this policy →](/guides/policy-testing/dangerous-actions#reconnaissance-activity) |


### Agent Configuration Policies

| Policy Name | Severity | Trigger | Test Guide |
|  --- | --- | --- | --- |
| Ungoverned Public Agent Vulnerable to Manipulation | Critical | Agent config change | [Test this policy →](/guides/policy-testing/agent-configuration#ungoverned-public-agent-vulnerable-to-manipulation) |
| Insecure Coding Agent Configuration | High | Agent config change | [Test this policy →](/guides/policy-testing/agent-configuration#insecure-coding-agent-configuration) |
| Agent Instruction Poisoning | High | Agent config change | [Test this policy →](/guides/policy-testing/agent-configuration#agent-instruction-poisoning) |
| Agent Memory Poisoning | High | Agent config change | [Test this policy →](/guides/policy-testing/agent-configuration#agent-memory-poisoning) |
| Identity Security Risks in Tools | High | Agent config change | [Test this policy →](/guides/policy-testing/agent-configuration#identity-security-risks-in-tools) |
| Personal Account Usage | High | Agent config change | [Test this policy →](/guides/policy-testing/agent-configuration#personal-account-usage) |
| Externally Exposed Agent Without an Owner | High | Agent config change | [Test this policy →](/guides/policy-testing/agent-configuration#externally-exposed-agent-without-an-owner) |
| Public Agent Instruction Vulnerabilities | High | Agent config change | [Test this policy →](/guides/policy-testing/agent-configuration#public-agent-instruction-vulnerabilities) |
| Missing Agent Owner | Medium | Agent config change | [Test this policy →](/guides/policy-testing/agent-configuration#missing-agent-owner) |
| Coding Agent Telemetry Enabled | Low | Agent config change | [Test this policy →](/guides/policy-testing/agent-configuration#coding-agent-telemetry-enabled) |
| Experimental Model Usage | Low | Agent config change | [Test this policy →](/guides/policy-testing/agent-configuration#experimental-model-usage) |


### Tool and Data Source Policies

| Policy Name | Severity | Trigger | Test Guide |
|  --- | --- | --- | --- |
| Tool Poisoning Attack Risk | Critical | Agent config change | [Test this policy →](/guides/policy-testing/agent-configuration#tool-poisoning-attack-risk) |
| Sensitive Data Exposure Risk | High | Agent config change | [Test this policy →](/guides/policy-testing/agent-configuration#sensitive-data-exposure-risk) |
| Excessive or Unused Tool Permissions | Medium | Agent config change | [Test this policy →](/guides/policy-testing/agent-configuration#excessive-or-unused-tool-permissions) |


### MCP Server Policies

| Policy Name | Severity | Trigger | Test Guide |
|  --- | --- | --- | --- |
| MCP Server with Malicious Reputation | Critical | Agent config change | [Test this policy →](/guides/policy-testing/mcp-and-skills#reputation-policies) |
| MCP Hidden Instructions | High | Agent config change | [Test this policy →](/guides/policy-testing/mcp-and-skills#mcp-hidden-instructions) |
| MCP Name Squatting | High | Agent config change | [Test this policy →](/guides/policy-testing/mcp-and-skills#mcp-name-squatting) |
| Over-Permissioned MCP Server Exposed to Untrusted Content | High | Agent config change | [Test this policy →](/guides/policy-testing/mcp-and-skills#over-permissioned-mcp-server-exposed-to-untrusted-content) |
| Single-Server MCP Lethal Trifecta | High | Agent config change | [Test this policy →](/guides/policy-testing/mcp-and-skills#single-server-mcp-lethal-trifecta) |
| MCP Server with Suspicious Reputation | High | Agent config change | [Test this policy →](/guides/policy-testing/mcp-and-skills#reputation-policies) |


### Skill Policies

| Policy Name | Severity | Trigger | Test Guide |
|  --- | --- | --- | --- |
| Skill with Data Exfiltration | Critical | Agent config change | [Test this policy →](/guides/policy-testing/mcp-and-skills#skill-with-data-exfiltration) |
| Skill with Malicious Reputation | Critical | Agent config change | [Test this policy →](/guides/policy-testing/mcp-and-skills#reputation-policies) |
| Skill with Hardcoded Secrets | High | Agent config change | [Test this policy →](/guides/policy-testing/mcp-and-skills#skill-with-hardcoded-secrets) |
| Skill with Prompt Injection | High | Agent config change | [Test this policy →](/guides/policy-testing/mcp-and-skills#skill-with-prompt-injection) |
| Skill with Suspicious Reputation | High | Agent config change | [Test this policy →](/guides/policy-testing/mcp-and-skills#reputation-policies) |


## Verifying Results

Violations appear on two pages in the Capsule portal, depending on the policy type:

- **Posture** - violations from configuration policies (agents, MCP servers, skills, tools, data sources)
- **Runtime** - violations from session policies (data exposure, prompt injection, operational safety)


After running any test scenario:

1. Open the **Posture** or **Runtime** page
2. Look for a new violation matching the scenario you tested
3. Click the violation to see:
  - **Violation category** - The specific violation category that was detected
  - **Evidence** - Quoted content from the session or configuration that triggered the detection
  - **Policy** - Which policy matched and its severity
  - **Session** - Link to the full agent session for context (runtime violations)


## Tips for Testing

- Run one scenario at a time for clear results
- Allow some time after the agent session for analysis to complete
- Start a new agent session after a configuration change, so Capsule picks up the new setup
- Many detections are judged by an AI model against the full context, so a scenario that looks contrived may be classified differently from a realistic one. If a scenario doesn't trigger, make it more concrete rather than more extreme
- Start with **Monitoring** mode - switch to **Prevention** mode only after validating detections work
- Use a dedicated test environment or sandbox agent if available