02Policies · What may it do?
A policy is a short list of rules. Each says allow, deny or require approval for an operation, optionally above an amount. Gasket evaluates them for every request, and the answer always names the rule that decided it. Edit the one below; the real engine runs as you type.
policy rules · editable
Request
Decision
Needs approval
Require approval for stripe.refund.create when amount > 50
- 1Allow stripe.refund.creatematches
- 2Require approval for stripe.refund.create when amount > 50decides
- 3Allow github.**
- 4Deny github.repo.delete
Runs the same evaluate() function as the API. Nothing is sent anywhere.
How a decision is made
- 01MatchEvery rule whose pattern matches service.operation is considered, and amount thresholds are checked against the request's amount.
- 02Most restrictive winsDeny beats require approval, which beats allow. A broad allow can't override a narrow deny, whatever the order.
- 03Fail closedNo matching rule means denied. An agent with no policy is denied everything. A threshold rule applies when the request leaves out the amount.
- 04VersionedEvery saved change creates a new version. Each action records the policy version and rule that decided it.
Pattern syntax
| match | means | covers |
|---|---|---|
| stripe.refund.create | exactly that operation | stripe.refund.create |
| stripe.*.create | one segment, any value | stripe.refund.create, stripe.customer.create |
| github.** | everything under github | github.issue.create, github.repo.delete |
| * | any service, any operation | everything |