Policy Catalog

Automated policies are RioSQL templates that evaluate traffic over time and produce local rule decisions. Proxyble reads the available templates from /opt/proxyble/templates/RioSQL/policies on an installed host, so use sudo proxyble --policies-list to inspect what is deployed in your environment.

RioDB is optional and has its own license. Add it only after the listener and backend are healthy, and validate a policy with controlled traffic before relying on it in production.

Traffic integrity and abuse

• analytics_skew_and_noise_control: repetitive synthetic traffic that pollutes metrics, counters, forms, or ranking signals.
• api_flood_control: sudden request floods, broad endpoint spread, error pressure, and connection bursts.
• business_flow_automation_control: valid-looking business actions performed too quickly or persistently.
• gray_zone_automation_shaping: clients that remain near static limits with little idle time.
• known_bad_source_ejection: high-confidence hostile sources and repeated severe violations.

Authentication and endpoint discovery

• credential_pressure_control: credential stuffing and password guessing against login, token, authentication, and session endpoints.
• endpoint_discovery_control: route scanning, hidden-endpoint probing, uncommon methods, and high 400, 404, or 405 response ratios.
• retry_storm_control: broken clients that retry rapidly after 429, 5xx, or 503 responses.

Cost, extraction, and origin pressure

• cache_miss_and_origin_pressure_control: cache-miss-heavy variants, query-string churn, and origin pressure.
• expensive_endpoint_cost_control: traffic that creates excessive latency, compute cost, or timeout pressure.
• large_download_and_export_control: repeated exports, archive or report downloads, and very large responses.
• scraping_and_ai_crawler_cost_control: successful reads, broad URL traversal, and crawler-like extraction.

Connection and agentic-client pressure

• legitimate_burst_protection: sharp but clean traffic bursts that need short pressure relief rather than a long ban.
• mcp_session_occupancy_control: long-lived or excessive MCP streaming sessions and reconnect churn.
• mcp_tool_pressure_control: agentic MCP tool or resource calls at machine speed.
• slow_client_and_connection_hoarding_control: slow connections, long request duration, low throughput, or high connection occupancy.

Deploy deliberately

Policy compatibility depends on listener visibility. Policies that need paths, methods, headers, or response signals require HTTP mode or HTTPS mode with TLS termination; TCP mode is appropriate for HTTPS pass-through and connection-level controls.

sudo proxyble --policies-deploy \
  --policy api_flood_control \
  --restart-riodb

sudo proxyble --policies-list

Use Automated Detection Policies for the operational workflow, and Manual Rules and Automated Policies when deciding whether automation is appropriate for a specific incident.