Policies
Control who can perform an action on an exact Constal Resource and constrain the operation that is allowed.
A Policy evaluates normalized identity, an action, an exact Constal Resource Name, and bounded request context. Authorization is deny by default, explicit deny wins, and scopes can narrow existing grants but cannot manufacture authority. Policies can allow, deny, require approval, substitute safe values, constrain arguments or context, and grant short-lived capabilities.
Policies are ordinary versioned Resources. A package can contain deterministic executable Policy code, while managed Policies can use validated declarative rules. Runs pin the effective Policy hashes accepted at admission so replay does not silently gain new authority when a current Policy changes.
Where Policies apply
| Boundary | Examples |
|---|---|
| Platform API | Read, create, update, control, export, or deploy actions |
| Agent execution | Start a Run, call a model, use a Tool, commit or deliver a result |
| Resource invocation | Exact Resource, operation, arguments, effect, and Credential use |
| Channel ingress | Authenticated principal, customer mapping, target, and dispatch |
| Runtime control | Resolve a wait, steer, pause, rebind, truncate, or cancel |
Choose an interface
| Interface | Use it for |
|---|---|
| Console | Reviewing deployed Policies, attachments, and decisions |
| SDK | Authoring deterministic executable Policy behavior |
| CLI | Deploying packages and evaluating exact test requests |
| Platform API | Policy-aware administration and scoped assignments |
Use Author a Policy to build and test deterministic behavior. Use Operate Policies to evaluate, attach, version, and inspect effective decisions.