@@ -71,7 +71,9 @@ primary conditions are the tool's name and its arguments.
7171
7272#### Tool Name
7373
74- The `toolName` in the rule must match the name of the tool being called.
74+ The `toolName` in the rule must match the name of the tool being called. For a
75+ complete list of built-in tool names, see the
76+ [Tools reference](/docs/reference/tools#available-tools).
7577
7678- **Wildcards**: You can use wildcards to match multiple tools.
7779 - `*`: Matches **any tool** (built-in or MCP).
@@ -87,7 +89,9 @@ The `toolName` in the rule must match the name of the tool being called.
8789
8890If `argsPattern` is specified, the tool' s arguments are converted to a stable
8991JSON string, which is then tested against the provided regular expression. If
90- the arguments don' t match the pattern, the rule does not apply.
92+ the arguments don' t match the pattern, the rule does not apply. For a list of
93+ argument keys available for each tool, see the **Parameters** in the
94+ [Tools reference](/docs/reference/tools#available-tools).
9195
9296#### Execution environment
9397
@@ -279,7 +283,11 @@ directory are **ignored**.
279283
280284### TOML rule schema
281285
282- Here is a breakdown of the fields available in a TOML policy rule:
286+ This section describes the fields available in a TOML policy rule.
287+
288+ For valid built-in ` toolName` values and their argument structures (used by
289+ ` argsPattern` ), see the
290+ [Tools reference](/docs/reference/tools#available-tools).
283291
284292` ` ` toml
285293[[rule]]
@@ -365,6 +373,9 @@ priority = 10
365373
366374To simplify writing policies for ` run_shell_command` , you can use
367375` commandPrefix` or ` commandRegex` instead of the more complex ` argsPattern` .
376+ These are policy-rule shorthands, not arguments of the ` run_shell_command` tool
377+ itself. For the tool' s invocation arguments, see [Shell tool](/docs/tools/shell)
378+ and [Tools reference](/docs/reference/tools#available-tools).
368379
369380- `commandPrefix`: Matches if the `command` argument starts with the given
370381 string.
0 commit comments