Policy: File Access Approval Policy for pgAdmin Application

This example shows a File Access policy that targets a specific application (pgAdmin) and requires Approval before allowing the file access action to proceed. It’s useful for demonstrating how to introduce an approval workflow for a trusted tool without applying prompts to every application on the endpoint.

---

What This Policy Does

• Applies a File Access rule in enforce mode.

• Targets:

  • Any user (*)

  • A specific application (one App ID, representing pgAdmin)

  • One specific endpoint (one Machine ID)

• On a match, it requires Approval (OnSuccess: APPROVAL).

• Does not require the user to acknowledge the notification.

---

Why It Behaves This Way

• Application-Scoped Policy: Because the application targeting is a single App ID (not *), only that specific application is evaluated by this rule.

• Broad User Scope: The wildcard user targeting means any user on the targeted endpoint can trigger the approval workflow.

• Approval On Success: When the policy matches, it intentionally routes the action into an approval flow instead of allowing it silently.

• Standard Checks With No Extra Constraints: Date/Time/Day/Certificate restrictions are empty, so the behavior largely depends on whether the user, machine, and application match

---

What The User Experiences

• When users run pgAdmin (or the targeted pgAdmin component) on an in-scope endpoint, they will be prompted to request Approval for the covered file activity.

• Because acknowledgement is not required, the notification itself should not add an extra “click to continue” step beyond the approval workflow.

---

Important Notes And Common Adjustments

• Fix The Notification Message: The current notification text references “monitor mode” and mentions MFA/justification/request to run as administrator, but this is a File Access policy requiring Approval. Update or remove the message so it matches actual behavior.

• Reduce Approval Noise: If the approval prompts are too frequent, narrow scope further (for example, limit the covered file paths or file types in the policy’s Extension section, where applicable).

• Narrow The User Scope If Needed: Replace * with specific users/groups if only certain users should be able to request approval for pgAdmin activity.

• Consider Certificate Constraints: If supported in your environment, restricting to a known signer/publisher can help ensure approvals apply only to trusted builds of the application.

Example JSON

{
	"PolicyName": "_7_fileAccess_pgAdmin_app",
	"PolicyType": "FileAccess",
	"PolicyId": "N0N1N2N3N4N5N6N7N8N9N",
	"Status": "enforce",
	"Actions": {
		"OnSuccess": {
			"Controls": [
				"APPROVAL"
			]
		},
		"OnFailure": {
			"Command": ""
		}
	},
	"NotificationMessage": "A policy has been set to monitor mode.  When this policy is enabled, [mfa, justification, request] will be required to run this process as an administrator.",
	"NotificationRequiresAcknowledge": false,
	"RiskLevel": 50,
	"Operator": "And",
	"Rules": [
		{
			"RuleName": "UserCheck",
			"ErrorMessage": "This user is not included in this policy",
			"RuleExpressionType": "BuiltInAction",
			"Expression": "CheckUser()"
		},
		{
			"RuleName": "MachineCheck",
			"ErrorMessage": "This Machine is not included in this policy",
			"RuleExpressionType": "BuiltInAction",
			"Expression": "CheckMachine()"
		},
		{
			"RuleName": "ApplicationCheck",
			"ErrorMessage": "This application is not included in this policy",
			"RuleExpressionType": "BuiltInAction",
			"Expression": "CheckFile(false)"
		},
		{
			"RuleName": "DateCheck",
			"ErrorMessage": "Current date is not covered by this policy",
			"RuleExpressionType": "BuiltInAction",
			"Expression": "CheckDate()"
		},
		{
			"RuleName": "TimeCheck",
			"ErrorMessage": "Current time is not covered by this policy",
			"RuleExpressionType": "BuiltInAction",
			"Expression": "CheckTime()"
		},
		{
			"RuleName": "DayCheck",
			"ErrorMessage": "Today is not included in this policy",
			"RuleExpressionType": "BuiltInAction",
			"Expression": "CheckDay()"
		},
		{
			"RuleName": "CertificateCheck",
			"ErrorMessage": "Certificate hash is not included in this policy",
			"RuleExpressionType": "BuiltInAction",
			"Expression": "CheckCertificate()"
		}
	],
	"UserCheck": [
		"*"
	],
	"MachineCheck": [
		"NSBYFNaHnhkIgVIazYhFXA"
	],
	"ApplicationCheck": [
		"_tJRBF6ZsehQ3kyOfIpQBA"
	],
	"DayCheck": [],
	"DateCheck": [],
	"TimeCheck": [],
	"CertificationCheck": [],
	"Extension": {}
}