| name | create-forwarding-rule |
| disable-model-invocation | true |
| argument-hint | <rule_name> <action: bypass|intercept> [app_name] [user_or_group] |
| description | Create a ZPA client forwarding policy rule to bypass or intercept traffic. |
Create ZPA Forwarding Policy Rule
Create forwarding rule: $ARGUMENTS
Step 1: Parse Input
Extract:
- Rule name
- Action: BYPASS (direct access), INTERCEPT (through ZPA), or INTERCEPT_ACCESSIBLE
- Application to apply to (optional)
- User or group (optional)
Step 2: Look Up Required IDs
zpa_list_application_segments()
zpa_list_scim_groups()
```text
## Step 3: Build Conditions
Construct conditions similar to access policy rules.
**Bypass for specific app:**
```json
[{"operands": [{"object_type": "APP", "values": ["<segment_id>"]}]}]
```text
## Step 4: Create the Rule
```text
zpa_create_forwarding_policy_rule(
name="<rule_name>",
action="<BYPASS|INTERCEPT|INTERCEPT_ACCESSIBLE>",
conditions=[...]
)
```text
## Step 5: Verify
```text
zpa_list_forwarding_policy_rules()
```text
Confirm rule creation and position. Present summary noting that BYPASS means traffic goes directly without ZPA interception.
