Policies
Rules that allow, deny or require approval.
json
[
{ "effect": "allow", "match": "orders.lookup" },
{ "effect": "allow", "match": "stripe.refund.create" },
{ "effect": "require_approval", "match": "stripe.refund.create", "when": { "amount_gt": 50 } },
{ "effect": "deny", "match": "github.repo.delete" }
]Matching
| match | Covers |
|---|---|
| stripe.refund.create | exactly that |
| stripe.*.create | one segment, any value |
| github.** | everything under github |
| * | everything |
Decisions
- Every matching rule is considered. Deny beats require_approval, which beats allow.
- No matching rule: denied. No policy: denied.
- when.amount_gt applies when the request's amount is above the threshold, and also when the request has no amount, so it can't be skipped by leaving it out.
- Each save creates a new version; actions record the version that decided them.
GET/v1/policiesscope policies:read
Something wrong or missing? Tell us · Stuck? Help center