# Policies

> Enriches a flow without touching the upstream: set, remove or rename headers, rewrite a path, filter a response's fields, mask personal data, translate an…

Concept - Since version 0.1.0 - Flexway v1.6.3 - https://flexway.io/en/docs/product-policies/

> Product guide: what the capability brings, for whom, its limits and the version that delivered it - no configuration syntax.

| | |
| --- | --- |
| **What it does** | Enriches a flow without touching the upstream: set, remove or rename headers, rewrite a path, filter a response's fields, mask personal data, translate an upstream's non-standard status, ask a third-party service before relaying. Policies attach at four levels (global, host, routes, operation), the most precise wins, under CEL conditions compiled at load |
| **Why it matters** | What elsewhere takes a plugin each team maintains becomes a declaration reviewed in Git. An effective chain is **simulated** before it is deployed: you know which policy applies to which request, without calling the upstream |
| **Use cases** | Serve only a closed list of fields to a partner; mask an IBAN in a response; turn a legacy system's `200 {"error":...}` into a real `404`; ask a risk service whether it accepts an order |
| **Limits** | No embedded code: WebAssembly modules are a `2.0.0` candidate; an external call always declares its timeout and its failure behaviour, never defaulted; no negotiated compression before `1.8.0` |
| **Since** | `0.1.0` (policy engine), `1.0.0` (simulation), `1.2.0` (response body and status, external call) |
| **Configure** | [Enriching a flow](https://flexway.io/en/docs/operations-policies/), [Reshaping a response](https://flexway.io/en/docs/operations-response-body/), [Delegating a decision to a service](https://flexway.io/en/docs/operations-external-call/) |