# AI Gateway Policy Templates

A team's **policy template** is the policy chain that apps created in that team
start with. Use templates to make sure every app in a team begins with your
required policies—Budgets and Costs with a sensible budget, a guardrail, your
custom compliance policy—while controlling what individual apps may change.

## How templates apply

When an app is created in a team, the team's template is copied into the app as
its starting [policy chain](./policy-chains.mdx). From that point on, the chain
belongs to the app.

A new team's template starts with the **API Key Authentication** policy as a
locked entry, so every app created in the team requires its API key from the
start. A new sub-team starts by
[inheriting its parent's template](#inheriting-from-a-parent-team) instead of
defining its own.

:::caution{title="Template edits don't change existing apps"}

A template is a starting point, not a live link. Editing a team's template
affects apps created afterwards—it never changes the chains of the team's
existing apps. To change a running app's behavior, edit that app's chain on its
Policies tab.

:::

## Editing a template

Open a team and select its **Policies** tab. The template editor works like the
app chain editor: add policies from the gateway's declared menu, order them, and
configure their options.

Each policy in the template carries two checkboxes that control what an app
starting from the template may do with that entry. Both start checked—a policy
you add to a template stays locked until you uncheck the boxes:

| Checkbox                                                | When checked                                                        |
| ------------------------------------------------------- | ------------------------------------------------------------------- |
| **Cannot edit** (`canEdit: false` in configuration)     | Apps can't change the entry's options—the template's settings apply |
| **Cannot delete** (`canRemove: false` in configuration) | Apps can't remove the entry from their chain                        |

Locked entries appear in the app's chain with a lock icon and the note "Locked
by the team policy template".

## Inheriting from a parent team

A sub-team can use its parent team's template instead of defining its own,
controlled by the **Inherit from parent** switch on the sub-team's Policies tab.
While inheriting, the sub-team's template is read-only—it shows the parent's
effective template. Turn the switch off to give the sub-team its own template:
the editor starts from a copy of the parent's effective template, which you then
adjust. Turning inheritance back on discards the sub-team's own template in
favor of the parent's.

## Next steps

- [Policy Chains](./policy-chains.mdx): how an app's chain executes
- [Managing Teams](./managing-teams.mdx): creating teams and sub-teams
- [Custom Policies](./custom-policies.mdx): put your own policy in a template