Docs · Policies

Policies

Everything that decides whether an actor may cause an effect is a Policy on the product graph.

Policies are typed JSON-LD DataObjects (schema:policy). They express Principal × Action × Resource × Condition → Effect, evaluated by one Policy Decision Point (PDP). That is the AWS IAM idea — as data on $G$ , not as a parallel IAM console.

What Policies govern

Action	Meaning
`graph.write` / `graph.delete`	Mutate product DataObjects
`merge.submit`	Personal → Dev merge request
`promote.pin`	Pin a Release to Test/Prod
`secret.use`	Resolve a sealed vault handle
`policy.mutate` / `policy.activate`	Change Policies themselves
`integration.call` / `agent.invoke` / `workflow.control`	Runtime controls

Effects: deny > require_human > allow.

What Policies are not

Layer	Role
SIV	Integrity of a change ( $I$ ) — structure, types, refs, semantic rules. Policies may require `sivMode: enforce`; they do not replace SIV.
Vault crypto	How secrets are sealed. Who may use a seal is Policy.
Pin pointer	Immutable version mechanics. Who may move the pin is Policy.

See also SIV and the book chapters on governance and control plane.

Ladder

Personal (IDE) ──merge──► Dev ──release──► snapshot
                              │
                         promote (Policy + HITL)
                              ▼
                       Test pin ──► Prod pin

IDE craft is governed by Policies on the Personal environment. Shared Dev is not a free write surface for IDE keys once Personal-only Policies are active. Promote never writes Prod in place — it moves a pin.

Console vs IDE

Surface	Job
Console → Ops → Governance → Policies	View active Policies, effective $\mathcal{A}$ , activate drafts
IDE	`platform_policy_simulate` (read). Propose drafts only if Policy allows

Shape (minimal)

{
  "schemaRef": "schema:policy",
  "state": "active",
  "data": {
    "name": "Builders craft Personal only",
    "effect": "allow",
    "actions": ["graph.write"],
    "principals": { "roles": ["builder"] },
    "resources": { "envs": ["personal"] },
    "priority": 100
  }
}

Bootstrap Policies seed every Organization so today's role×pillar and env ladder keep working until you customize.