Author and publish a policy

Validate a policy version and prove its effect at runtime.

Before you start

Use an identity with policy authoring and publication permissions. Identify the principal, tools, environment, and intended allow and deny cases.

Procedure

1. Create a policy draft in the console. Use the target environment’s entity references.

2. Validate the draft and resolve syntax or reference errors.

3. Simulate both an intended allow and a deny. Include a case where an explicit deny overlaps an allow.

4. Publish the reviewed version. Check runtime projection acceptance before testing the governed endpoint.

Verify the result

Repeat the allow and deny calls with the intended identity. Confirm the audit decision records the expected policy version.

If it does not work

If simulation passes but runtime differs, compare identity context, resource references, and projection freshness. Do not add a broader allow to hide the mismatch.

Read the related concept or consult the Admin API for exact request fields.

Implementation reference

Read the source contract.