Documentation / Policies / Operate

Operate Policies

Evaluate, attach, version, and audit Policies without silently changing the authority of accepted Runs.

Before you begin

Obtain policy:evaluate for the target namespace and the management authority required for any Resource you will change. Record the current Policy CRN and hash. Prepare both positive and negative test inputs, including the exact principal/customer context used in production.

Steps

  1. Open Policies and inspect the Policy identity, version, evaluator, deployment revision, status, and most recent publication.
  2. Test a decision before attachment:
sh
curl https://platform.constal.ai/v1/namespaces/default/policies/ticket-read-boundary/evaluate \
  -H "Authorization: Bearer $CONSTAL_API_KEY" \
  -H "Content-Type: application/json" \
  --data '{
    "action":"resource:invoke",
    "resource":"crn:constal:production:acme:default:service/tickets",
    "context":{"resource.operation":"ticket.read"}
  }'
  1. Attach the exact Policy CRN through the Agent, Channel, Resource, or provider manifest/configuration that owns the boundary. Redeploy immutable executable packages when their manifest attachment changes.
  2. Start a controlled Run and inspect the accepted Policy hash and per-invocation evaluations.
  3. Publish a new Policy version through the deployment API. Do not assume existing Runs adopt it: they retain their accepted Policy snapshot unless an authenticated safe-point Policy control explicitly changes it.
  4. Roll back by publishing or reattaching a known immutable version, then repeat the negative tests.

Verify

Confirm denied operations stop before external dispatch and allowed operations contain the expected constraints. Verify explicit deny overrides an allow from another layer. For an existing Run, compare current Resource Policy with the pinned Run Policy and ensure any difference is intentional.

Next steps

Use Run operations for safe-point Policy changes, Use Resources from Agents for Resource bindings, and Analytics queries and exports for historical decision evidence.