What is New in v1.4
UMAI v1.4 introduces organization-scope policies and a hierarchical policy inheritance system. This is one of our most requested features, and we are excited to ship it.
Organization-Scope Policies
You can now create policies at the organization level that automatically apply to all projects and environments. This is ideal for company-wide rules like:
- Block all SSNs and credit card numbers in AI responses
- Log all prompts containing the word "confidential"
- Require human approval for AI-generated content exceeding 500 words
- Prevent any AI model from discussing competitor products
Previously, these rules had to be duplicated across every project. Now you define them once and they cascade automatically.
Policy Inheritance
Policies flow down the hierarchy: Organization → Project → Environment. At each level you can:
Extend: add new policies that apply only at that level and below. A project can add policies specific to its use case without affecting other projects.
Override: change the enforcement action for an inherited policy. For example, an organization policy might block PII in production but only alert in development.
Disable: turn off an inherited policy for a specific project or environment. This requires approval from an organization admin and is logged in the audit trail.
The inheritance chain is evaluated at request time, so changes propagate immediately — no redeployment required.
Policy Conflict Resolution
When multiple policies at different levels could apply to the same request, UMAI uses the following precedence:
- Most specific wins. An environment-level policy overrides a project-level policy, which overrides an organization-level policy.
- Most restrictive wins (within the same level). If two policies at the same level conflict, the more restrictive action (block > redact > alert > log) takes precedence.
- Explicit overrides are logged. When a lower-level policy overrides a higher-level one, the override is recorded in the audit trail with the identity of the person who created it.
New API Endpoints
- GET /v1/org/{org_id}/policies — list all organization-scope policies
- POST /v1/org/{org_id}/policies — create an organization-scope policy
- GET /v1/org/{org_id}/policies/effective?project={id}&env={env} — preview the effective policy set for a specific project and environment
- POST /v1/org/{org_id}/policies/{policy_id}/override — create a project-level override
Migration
Existing policies are unaffected. All current policies are treated as project-scope policies. You can promote any project-scope policy to organization-scope via the dashboard or API.
What is Next
We are working on policy templates — pre-built policy sets for common compliance frameworks (SOC 2, HIPAA, EU AI Act) that you can apply at the organization level with one click. Expect this in v1.5.
Update to v1.4 today in your UMAI dashboard. If you are on a self-hosted deployment, the v1.4 release is available in your deployment registry.