Operate Policies with the CLI

Deploy, inspect, and evaluate immutable Policies before attaching them to operational boundaries.

Before you begin

Prepare a Policy package or existing Policy CRN, representative allowed and denied inputs, and policy:evaluate authority. Keep principal and customer context faithful to production and target the exact Resource CRN rather than a display name.

Steps

1. Deploy an executable Policy package through constal deployments create policy.zip and poll publication.
2. Put the normalized test input in a reviewed file containing action, resource, and optional bounded context.
3. Evaluate it through the public Policy endpoint:

constal policies evaluate ticket-boundary --body @policy-input.json --output json

4. Repeat with a negative case and confirm explicit denial and expected constraints.
5. Attach the exact Policy through the Agent, Channel, Resource, provider, customer Policy binding, or other boundary that owns it. Redeploy immutable manifests when their attachments change.
6. Start a controlled Run and compare its pinned Policy hash with the currently deployed Policy.

The CLI does not provide an “attach everywhere” shortcut because each attachment has different ownership and replay semantics.

Verify

Confirm denied operations stop before external dispatch. Verify an existing Run retains its accepted Policy snapshot unless an authenticated safe-point Policy control changes it. Record the deployment and evaluation output for review.

Next steps

Use Author Policies with the SDK, Operate Policies, and the generated Policies command reference.