symbi-policy git:20261011.4243b1cA

Immutable. This exact content never changes and is served at /api/v1/blob/0dc74346c793357b.

---
name: symbi-policy
description: Draft and validate Cedar policies using the request schema of the selected execution route.
---

# Cedar policies

First determine whether the policy governs standalone plugin hooks or managed
runtime tools. They use different action namespaces and contexts. Inspect the
shipping request contract before using identity attributes or approvals.

## Standalone plugin contract

The CLI receives `tool_name` and complete `tool_input`, and constructs:

- principal: `Symbi::Agent::"claude-code"` (fixed by this CLI, including Cursor)
- action: `Symbi::Action::"tool_call::<native tool name>"`
- resource: `Symbi::Resource::"default"`
- context: `{ "tool_input": <original arguments> }`

For example, permit direct reads and content searches while leaving other calls
denied by default:

```cedar
permit(principal, action == Symbi::Action::"tool_call::Read", resource);
permit(principal, action == Symbi::Action::"tool_call::Grep", resource);
```

Claude Code shell calls use Bash; Cursor shell calls use Shell. This fixed
principal is not a verified user identity. Local exceptions do not bypass Cedar.

Validate with complete representative payloads, including denied controls:

```sh
printf '%s\n' '{"tool_name":"Read","tool_input":{"file_path":"README.md"}}' |
  symbi policy evaluate --stdin --json --policies /absolute/policies
```

Inspect the structured decision and reason. Exit zero alone does not establish
successful policy loading: the current runtime can return default allow when
built without Cedar or with no policies; the plugin rejects those results.
Do not use an empty `{}` event as evidence that a real request is permitted.

## Managed runtime

Start from the policies generated by the chosen runtime profile. The managed CLI
example uses `Action::"tool_call::claude_code"` for admission and exact tool
names for brokered calls. File roots, approval and budget checks are additional
runtime controls; a Cedar permit does not replace them.

Draft changes for operator review outside active policy directories. Do not modify
an active control file or use shell execution to circumvent a denied write.
Evaluate both allowed and forbidden representative requests before applying changes.