Drafting Rules with AI
Writing a policy rule means translating "what you want" into fields, operators, and values — and that translation is the slowest part. Drafting with AI does the first pass for you: describe the rule in plain language, review what Socket drafts, and accept what looks right.
Drafts are proposals, not changes. Nothing affects your policy until you accept a draft — and everything you accept is an ordinary rule you can edit afterwards.
Two Ways to Draft
| Draft with AI | Draft this rule with AI | |
|---|---|---|
| Where | The policy's rule list | Inside the rule editor |
| Output | Up to eight rules from one description | One rule |
| Best for | Setting up a policy — describe a whole posture at once | You know the one rule you want, but not which fields express it |
| On accept | The rule is added to the policy, at the end of the rule list | The draft fills the form you're editing — saved only when you save the rule |
Use Draft with AI when you would otherwise be writing several rules in a row:
Block malware and known exploits. Warn on high CVEs with a fix available. Monitor packages scored below 40.
Use Draft this rule with AI when you're already in the editor and stuck on the fields. If the form already has content, Socket warns you before a draft replaces it.
What It Understands
Descriptions can be as loose as you like. In practice it handles:
| You write | You get |
|---|---|
| "block typosquatting", "stop lookalike package names" | Rules over the relevant alert types, no field knowledge needed |
| "supply chain score under 50", "CVSS of 9 or higher" | Score and CVSS conditions with the right operator and threshold |
| "block this in Rust and Go" | Ecosystem conditions — common names map to Socket's ecosystems automatically |
| "published in the last 3 days" | A date-published condition with a relative window |
| "block critical CVEs everywhere except the sandbox repo" | A rule with a repository exception |
| "save me from CVE-2024-3094" | A rule matching that CVE identifier |
Drafts are built from the same fields, operators, and values the visual editor offers, so an accepted draft contains nothing you couldn't have built by hand — and nothing you can't edit afterwards. Rule names are composed by Socket from each rule's own structure, not written by the model.
What It Deliberately Won't Do
- Scope a rule to a repository. Policies are already assigned to repositories, so scoping belongs to the policy, not the rule. Ask for "block critical CVEs in payments-api" and you get the rule without the repository scoping — put
payments-apion the right policy to apply it. Repository names in a description become exceptions ("everywhere except the sandbox repo"), which is the one place repository conditions make sense. - Invent version ranges. Rules match versions by exact value, prefix, suffix, or substring — there are no ranges. "The lodash 4.x line" becomes a version starting with
4.. - Follow instructions embedded in the description. Your text is treated strictly as a requirement to translate into rule fields, never as commands to act on.
Reviewing Drafts
Review every draft before accepting it — drafts are a starting point, not an authority. For each one, check:
- The action — is this Block, Warn, Monitor, or Ignore, and is that what you meant?
- The conditions — do the fields and values match the requirement, with nothing extra and nothing missing?
- Where it lands — accepted drafts from the rule list are added at the end. Because the first matching rule wins, a new rule at the bottom may be shadowed by a broader rule above it. Reorder it if so.
If a draft is close but not right, accept it and edit it — it's a normal rule from that moment on. Dismissed drafts are simply discarded.
Availability
AI drafting is available on plans that include it. Each generation counts against a daily limit, shown in the drafting panel.
Related Pages
- Policies — the rule model drafts are built for: first match wins, conditions, exceptions, and actions.
- Resolve Alerts — for one-off findings, resolving the alert is usually the better tool than writing a rule.
Updated 1 day ago