# Policy Configuration

Policies define what telemetry data a team or service account can query. Each policy sets an access level — All, None, or Filtered — for each stream type: Metrics, Events, Logs, Traces, and APM.

For guidance on designing policies and understanding how multiple policies combine on a team, see [RBAC Policy Best Practices](https://docs.kloudfuse.com/platform/4.1.0/administration/authorization/policies/best-practices/).
For instructions on assigning policies to teams, see [Team Policy Assignment](https://docs.kloudfuse.com/platform/4.1.0/administration/authorization/policies/teams/).

## Navigate to Policies

1. Select the **Admin** tab, and then the **Policies** option in the drop-down menu.

2. The **Policies** interface appears, listing all existing policies.

## Create a Policy

1. In the **Policies** interface, click **New Policy**.

2. Enter a name for the policy.

3. For each stream type (Metrics, Events, Logs, Traces, APM), select an access level:

- **All Access** — full access to all data in this stream.
   - **No Access** — no access to this stream.
   - **Filtered Access** — access limited to data matching label filters you define.

4. If you selected **Filtered Access** for a stream, add one or more filter rules:
   1. Select a label **Key**.
   2. Select an **Operator** (for example, `=` or `!=`).
   3. Enter a **Value**.
   4. Repeat to add additional filter rules.

5. Click **Save** to create the policy.

## Access Levels

### All Access

The team has full access to all data in the selected stream. All Access cannot be narrowed by adding another policy to the same team — it is the highest possible access level for that stream.

### No Access

The team has no access to the selected stream. Another policy assigned to the same team can override this setting by granting Filtered or All Access.

### Filtered Access

The team can only query data that matches the label key/operator/value rules defined in the policy. All filter rules are applied to every query against that stream.

Filtered Access overrides No Access but cannot override All Access. When a team has multiple Filtered policies for the same stream, the results are the union of all filters — data matching any filter is returned.

## Delete a Policy

1. In the **Policies** interface, hover over the policy you plan to delete.
2. Click the **Delete** icon on the right.
3. Click **Delete** to confirm.

### Bulk Delete

1. Select multiple policies using the checkbox to the left of each row.
2. A **Delete** button appears showing the number of selected policies.
3. Click **Delete** to confirm.

|     |     |
| --- | --- |
|  | Deleting a policy removes it from any teams it was assigned to. Review team assignments before deleting a policy that is in active use. |