Skip to content
MCP Gateway

Simulate a policy decision

Policy simulation answers “would this exact request be allowed?” against a specific policy version, without affecting live traffic. Use it to validate a change before publishing, or to understand why a real call was denied.

Simulate a decision

Section titled “Simulate a decision”

Provide the principal, action, resource, and context — the same four inputs Cedar evaluates — and get back the decision, the matched rule, and the policy version.

Simulate whether a request is allowed
gatewayctl simulate-policy \
--user user_ada --agent sales-contract-agent \
--client-surface external-chat --environment prod \
--server legal-contract-review --tool contract_read \
--policy-version cedar-policy-v3 --format json

Every gatewayctl verb accepts --format text|json.

Diagnose a denial

Section titled “Diagnose a denial”

When a real call is denied, turn its stable machine reason into a human‑readable diagnosis — the matched (or missing) rule, the policy version, and safe context, with no payloads or secrets.

Diagnose why a request was denied
gatewayctl diagnose-deny invalid_auth_context

Every gatewayctl verb accepts --format text|json.

Compare a draft with the active policy

Section titled “Compare a draft with the active policy”

When reviewing a draft, include activePolicyVersion with the version it would replace. The candidate remains the decision at the top level. The response also includes baseline, the active version’s outcome, and changed, which is true only when the two decisions differ.

Both versions require policy.validate access on their owner teams. If the active version cannot be compiled for simulation, the API returns 422 with policy_simulation_baseline_compile_failed; it never reports a missing baseline as no change. Without activePolicyVersion, the response remains the single-outcome shape.

Type set in Geist, Source Serif 4, and Departure Mono.