symbi-policy ยท diff
git:20260423.482efd7 to git:20261011.4243b1c
38 added, 34 removed. Audit A to A.
---
name: symbi-policy
- description: Create, edit, or validate Cedar authorization policies for Symbiont agents. Use when defining access control rules, setting up security policies, or debugging policy evaluation.
+ description: Draft and validate Cedar policies using the request schema of the selected execution route.
---
- # Cedar Policy Management
+ # Cedar policies
- Help the user create or modify Cedar policies for their Symbiont agents.
+ First determine whether the policy governs standalone plugin hooks or managed
+ runtime tools. They use different action namespaces and contexts. Inspect the
+ shipping request contract before using identity attributes or approvals.
- ## Cedar Policy Syntax Reference
+ ## Standalone plugin contract
- Cedar policies use `permit` and `forbid` to control access:
+ The CLI receives `tool_name` and complete `tool_input`, and constructs:
+ - principal: `Symbi::Agent::"claude-code"` (fixed by this CLI, including Cursor)
+ - action: `Symbi::Action::"tool_call::<native tool name>"`
+ - resource: `Symbi::Resource::"default"`
+ - context: `{ "tool_input": <original arguments> }`
+
+ For example, permit direct reads and content searches while leaving other calls
+ denied by default:
+
```cedar
- // Allow an agent to read from a specific resource
- permit(
- principal == Agent::"data-analyzer",
- action == Action::"read",
- resource in ResourceGroup::"public-datasets"
- );
+ permit(principal, action == Symbi::Action::"tool_call::Read", resource);
+ permit(principal, action == Symbi::Action::"tool_call::Grep", resource);
+ ```
- // Forbid writing PII unless the agent has HIPAA compliance
- forbid(
- principal,
- action == Action::"write",
- resource
- ) when {
- resource.contains_pii == true
- } unless {
- principal.compliance_level == "hipaa"
- };
+ Claude Code shell calls use Bash; Cursor shell calls use Shell. This fixed
+ principal is not a verified user identity. Local exceptions do not bypass Cedar.
+
+ Validate with complete representative payloads, including denied controls:
+
+ ```sh
+ printf '%s\n' '{"tool_name":"Read","tool_input":{"file_path":"README.md"}}' |
+ symbi policy evaluate --stdin --json --policies /absolute/policies
```
- ## Common Policy Patterns
+ Inspect the structured decision and reason. Exit zero alone does not establish
+ successful policy loading: the current runtime can return default allow when
+ built without Cedar or with no policies; the plugin rejects those results.
+ Do not use an empty `{}` event as evidence that a real request is permitted.
- When asked to create a policy, identify the pattern:
- - **Role-based**: Different agent roles get different permissions
- - **Resource-scoped**: Permissions vary by resource type/sensitivity
- - **Time-bounded**: Permissions that expire or are scheduled
- - **Approval-gated**: Actions requiring human approval
- - **Audit-all**: Log everything, permit/deny selectively
+ ## Managed runtime
- ## Workflow
+ Start from the policies generated by the chosen runtime profile. The managed CLI
+ example uses `Action::"tool_call::claude_code"` for admission and exact tool
+ names for brokered calls. File roots, approval and budget checks are additional
+ runtime controls; a Cedar permit does not replace them.
- 1. Ask what the policy should govern (which agents, which actions, which resources)
- 2. Identify the pattern from the list above
- 3. Write the Cedar policy
- 4. Save to `policies/` directory
- 5. Validate Cedar syntax: `symbi policy evaluate --stdin --policies ./policies/ <<< '{}' --json` (returns parse errors if any policy is malformed). For DSL agent files use `symbi dsl --file agents/<name>.dsl`.
+ Draft changes for operator review outside active policy directories. Do not modify
+ an active control file or use shell execution to circumvent a denied write.
+ Evaluate both allowed and forbidden representative requests before applying changes.