policy

Manage Cedar authorization policy groups, policies, and decisions (the agent-core-policy service).

A "policy group" is a container of policies owned by a user (max 20/user); each group holds "policies" — individual permit/forbid rules (max 10/group) compiled to Cedar at write time. A gateway binds a group via its policyGroupId, and its enforcement asks agent-core-policy for an allow/deny decision per inbound request. Policy resources are synchronous (no WAITING_* FSM, so there is no wait). There are two nested resources: policy groups and policies within a group.

grn agentbase policy <command> [options]

Available commands

Policy Group

Command	Description
group create	Create a policy group
group generate	Print a policy-group create template (YAML or JSON)
group list	List policy groups
group get	Show a policy group
group update	Update a policy group
group delete	Delete a policy group (cascades to its policies)

Group Policy

Command	Description
group policy create	Create a policy within a group
group policy generate	Print a policy create template (YAML or JSON)
group policy list	List policies within a group
group policy get	Show a policy
group policy update	Update a policy (merge-patch)
group policy delete	Delete a policy

Other

Command	Description
condition-operators	List accepted policy condition operators
decide	Probe an authorization decision for a gateway target