Policy documents

cardinal policy test access.cedar              # compile, offline
cardinal policy test access.cedar -dsn "$DSN"  # also: does every name exist?
cardinal policy publish access.cedar -activate
cardinal policy list                           # every version
cardinal policy show                           # the live set
cardinal policy activate 7                     # rollback is the same verb

Test with a connection if you can

policy test on its own compiles the document. Given a -dsn it also reports groups and applications the rules name that do not exist, and that is the mistake worth catching, because under a default-deny engine a rule naming a missing group behaves identically to a rule that is working.

Publish and activate are two verbs

A published version governs nothing until it is activated, so a set can be inspected, and its dangling references read, before it decides anything.

Activation takes effect without a restart. Every node checks the activated version on a short interval and reloads; the server that served the activation reloads immediately, because whoever pressed the button is about to check whether it worked.

A version that no longer compiles cannot be activated. It would otherwise be the one entry in the rollback list that fails at the worst possible moment, looking exactly like the others.

Where the document lives

The binary carries a default set, so cardinal-server init needs no files on disk. Once published, policy lives in the database: a deployment running the published image edits it the same way a source checkout does.

There is deliberately no policy editor in the console. A set typed into a browser is one nobody reviewed, and the argument for policy-as-code is that it is diffable and testable before it governs anything.

In the console

Policy lists published versions, shows how many rules each contains, and makes one live with a button. That is the rollback path. It warns before activating a set that does not grant you administration, because that is the last thing you would be able to do there.

It also shows when a version is activated but not live on the node you are talking to, which is a state that otherwise looks like nothing happening.