Policies
Note
Guide: draft. The source build implements the current behavior below; remaining design work is marked explicitly.
A policy is the complete set of rules, capabilities, defaults, and risk configuration that applies to an evaluation.
Layers
The designed layers are built-in, user, and workspace.
The current CLI loads .shiin/policy.toml as one operator-controlled layer; separate user/workspace loading and trust-by-hash are not implemented.
A workspace layer can restrict a user layer only; it can never make a deny into an allow unless the operator trusts it by hash.
Rules
A rule matches an action request and produces allow, deny, or pending.
Policies refer to action types, never to host tool names.
Default decision
When no rule matches, the decision is deny.
The default can be configured to pending, but it can never be allow.
Writing policy
Policy is written in TOML and compiled to Cedar. See Writing policies.