coder · jscottmiller · Apr 29, 2026 · Apr 29, 2026
diff --git a/cli/testdata/coder_provisioner_list_--output_json.golden b/cli/testdata/coder_provisioner_list_--output_json.golden
@@ -7,7 +7,7 @@
     "last_seen_at": "====[timestamp]=====",
     "name": "test-daemon",
     "version": "v0.0.0-devel",
-    "api_version": "1.17",
+    "api_version": "1.18",
     "provisioners": [
       "echo"
     ],

diff --git a/coderd/agentapi/subagent.go b/coderd/agentapi/subagent.go
@@ -150,6 +150,7 @@ func (a *SubAgentAPI) CreateSubAgent(ctx context.Context, req *agentproto.Create
 		DisplayApps:              displayApps,
 		DisplayOrder:             0,
 		APIKeyScope:              parentAgent.APIKeyScope,
+		DlpPolicyID:              parentAgent.DlpPolicyID,
 	})
 	if err != nil {
 		return nil, xerrors.Errorf("insert sub agent: %w", err)

diff --git a/coderd/database/dbauthz/dbauthz.go b/coderd/database/dbauthz/dbauthz.go
@@ -4268,6 +4268,27 @@ func (q *querier) GetTemplateVersionByTemplateIDAndName(ctx context.Context, arg
 	return tv, nil
 }
 
+func (q *querier) GetTemplateVersionDLPPoliciesByTemplateVersionID(ctx context.Context, templateVersionID uuid.UUID) ([]database.TemplateVersionDlpPolicy, error) {
+	if _, err := q.GetTemplateVersionByID(ctx, templateVersionID); err != nil {
+		return nil, err
+	}
+	return q.db.GetTemplateVersionDLPPoliciesByTemplateVersionID(ctx, templateVersionID)
+}
+
+func (q *querier) GetTemplateVersionDLPPolicyByAgentID(ctx context.Context, agentID uuid.UUID) (database.TemplateVersionDlpPolicy, error) {
+	if err := q.authorizeContext(ctx, policy.ActionRead, rbac.ResourceTemplate); err != nil {
+		return database.TemplateVersionDlpPolicy{}, err
+	}
+	return q.db.GetTemplateVersionDLPPolicyByAgentID(ctx, agentID)
+}
+
+func (q *querier) GetTemplateVersionDLPPolicyByVersionAndName(ctx context.Context, arg database.GetTemplateVersionDLPPolicyByVersionAndNameParams) (database.TemplateVersionDlpPolicy, error) {
+	if _, err := q.GetTemplateVersionByID(ctx, arg.TemplateVersionID); err != nil {
+		return database.TemplateVersionDlpPolicy{}, err
+	}
+	return q.db.GetTemplateVersionDLPPolicyByVersionAndName(ctx, arg)
+}
+
 func (q *querier) GetTemplateVersionParameters(ctx context.Context, templateVersionID uuid.UUID) ([]database.TemplateVersionParameter, error) {
 	// An actor can read template version parameters if they can read the related template.
 	tv, err := q.db.GetTemplateVersionByID(ctx, templateVersionID)
@@ -5672,6 +5693,13 @@ func (q *querier) InsertTemplateVersion(ctx context.Context, arg database.Insert
 	return q.db.InsertTemplateVersion(ctx, arg)
 }
 
+func (q *querier) InsertTemplateVersionDLPPolicy(ctx context.Context, arg database.InsertTemplateVersionDLPPolicyParams) (database.TemplateVersionDlpPolicy, error) {
+	if err := q.authorizeContext(ctx, policy.ActionUpdate, rbac.ResourceTemplate); err != nil {
+		return database.TemplateVersionDlpPolicy{}, err
+	}
+	return q.db.InsertTemplateVersionDLPPolicy(ctx, arg)
+}
+
 func (q *querier) InsertTemplateVersionParameter(ctx context.Context, arg database.InsertTemplateVersionParameterParams) (database.TemplateVersionParameter, error) {
 	if err := q.authorizeContext(ctx, policy.ActionCreate, rbac.ResourceSystem); err != nil {
 		return database.TemplateVersionParameter{}, err

diff --git a/coderd/database/dbauthz/dbauthz_test.go b/coderd/database/dbauthz/dbauthz_test.go
@@ -2131,6 +2131,37 @@ func (s *MethodTestSuite) TestOrganization() {
 		dbm.EXPECT().InsertPresetPrebuildSchedule(gomock.Any(), arg).Return(database.TemplateVersionPresetPrebuildSchedule{}, nil).AnyTimes()
 		check.Args(arg).Asserts(rbac.ResourceTemplate, policy.ActionUpdate)
 	}))
+	s.Run("InsertTemplateVersionDLPPolicy", s.Mocked(func(dbm *dbmock.MockStore, _ *gofakeit.Faker, check *expects) {
+		arg := database.InsertTemplateVersionDLPPolicyParams{ID: uuid.New(), TemplateVersionID: uuid.New(), Name: "strict"}
+		dbm.EXPECT().InsertTemplateVersionDLPPolicy(gomock.Any(), arg).Return(database.TemplateVersionDlpPolicy{}, nil).AnyTimes()
+		check.Args(arg).Asserts(rbac.ResourceTemplate, policy.ActionUpdate)
+	}))
+	s.Run("GetTemplateVersionDLPPoliciesByTemplateVersionID", s.Mocked(func(dbm *dbmock.MockStore, faker *gofakeit.Faker, check *expects) {
+		tpl := testutil.Fake(s.T(), faker, database.Template{})
+		tv := testutil.Fake(s.T(), faker, database.TemplateVersion{TemplateID: uuid.NullUUID{UUID: tpl.ID, Valid: true}, OrganizationID: tpl.OrganizationID, CreatedBy: tpl.CreatedBy})
+		resp := []database.TemplateVersionDlpPolicy{testutil.Fake(s.T(), faker, database.TemplateVersionDlpPolicy{TemplateVersionID: tv.ID})}
+
+		dbm.EXPECT().GetTemplateVersionByID(gomock.Any(), tv.ID).Return(tv, nil).AnyTimes()
+		dbm.EXPECT().GetTemplateByID(gomock.Any(), tpl.ID).Return(tpl, nil).AnyTimes()
+		dbm.EXPECT().GetTemplateVersionDLPPoliciesByTemplateVersionID(gomock.Any(), tv.ID).Return(resp, nil).AnyTimes()
+		check.Args(tv.ID).Asserts(tpl.RBACObject(), policy.ActionRead).Returns(resp)
+	}))
+	s.Run("GetTemplateVersionDLPPolicyByVersionAndName", s.Mocked(func(dbm *dbmock.MockStore, faker *gofakeit.Faker, check *expects) {
+		tpl := testutil.Fake(s.T(), faker, database.Template{})
+		tv := testutil.Fake(s.T(), faker, database.TemplateVersion{TemplateID: uuid.NullUUID{UUID: tpl.ID, Valid: true}, OrganizationID: tpl.OrganizationID, CreatedBy: tpl.CreatedBy})
+		arg := database.GetTemplateVersionDLPPolicyByVersionAndNameParams{TemplateVersionID: tv.ID, Name: "strict"}
+		row := testutil.Fake(s.T(), faker, database.TemplateVersionDlpPolicy{TemplateVersionID: tv.ID, Name: "strict"})
+
+		dbm.EXPECT().GetTemplateVersionByID(gomock.Any(), tv.ID).Return(tv, nil).AnyTimes()
+		dbm.EXPECT().GetTemplateByID(gomock.Any(), tpl.ID).Return(tpl, nil).AnyTimes()
+		dbm.EXPECT().GetTemplateVersionDLPPolicyByVersionAndName(gomock.Any(), arg).Return(row, nil).AnyTimes()
+		check.Args(arg).Asserts(tpl.RBACObject(), policy.ActionRead).Returns(row)
+	}))
+	s.Run("GetTemplateVersionDLPPolicyByAgentID", s.Mocked(func(dbm *dbmock.MockStore, faker *gofakeit.Faker, check *expects) {
+		agentID := uuid.New()
+		dbm.EXPECT().GetTemplateVersionDLPPolicyByAgentID(gomock.Any(), agentID).Return(testutil.Fake(s.T(), faker, database.TemplateVersionDlpPolicy{}), nil).AnyTimes()
+		check.Args(agentID).Asserts(rbac.ResourceTemplate, policy.ActionRead)
+	}))
 	s.Run("DeleteOrganizationMember", s.Mocked(func(dbm *dbmock.MockStore, faker *gofakeit.Faker, check *expects) {
 		o := testutil.Fake(s.T(), faker, database.Organization{})
 		u := testutil.Fake(s.T(), faker, database.User{})

diff --git a/coderd/database/dbgen/dbgen.go b/coderd/database/dbgen/dbgen.go
@@ -564,6 +564,7 @@ func WorkspaceAgent(t testing.TB, db database.Store, orig database.WorkspaceAgen
 			DisplayApps:              nil,
 			DisplayOrder:             agt.DisplayOrder,
 			APIKeyScope:              agt.APIKeyScope,
+			DlpPolicyID:              agt.DlpPolicyID,
 		})
 		require.NoError(t, err, "insert workspace agent subagent antagonist")
 		err = db.DeleteWorkspaceSubAgentByID(genCtx, subAgt.ID)

diff --git a/coderd/database/dbmetrics/querymetrics.go b/coderd/database/dbmetrics/querymetrics.go
diff --git a/coderd/database/dbmock/dbmock.go b/coderd/database/dbmock/dbmock.go
diff --git a/coderd/database/dump.sql b/coderd/database/dump.sql