Policy Builder

Two builders, same backend:

Quickstart (3 steps) — Effect → Target → Subject. The default entry path. Live policy-name preview as you go.

Advanced (5 steps) — Name, effect, scope, simulation, publish. For wildcards, side-effect-type filters, complex resource selectors.

After publish, the Quick-Test panel shows ALLOW + DENY examples so you can see your policy in action immediately.

Effect — deny overrides any matching allow. The default behavior is implicit deny, so for sensitive resources you usually want deny.