| name | symbi-policy |
| description | Create, edit, or validate Cedar authorization policies for Symbiont agents. Use when defining access control rules, setting up security policies, or debugging policy evaluation. |
Cedar Policy Management
Help the user create or modify Cedar policies for their Symbiont agents.
Cedar Policy Syntax Reference
Cedar policies use permit and forbid to control access:
// Allow an agent to read from a specific resource
permit(
principal == Agent::"data-analyzer",
action == Action::"read",
resource in ResourceGroup::"public-datasets"
);
// Forbid writing PII unless the agent has HIPAA compliance
forbid(
principal,
action == Action::"write",
resource
) when {
resource.contains_pii == true
} unless {
principal.compliance_level == "hipaa"
};
Common Policy Patterns
When asked to create a policy, identify the pattern:
- Role-based: Different agent roles get different permissions
- Resource-scoped: Permissions vary by resource type/sensitivity
- Time-bounded: Permissions that expire or are scheduled
- Approval-gated: Actions requiring human approval
- Audit-all: Log everything, permit/deny selectively
Workflow
- Ask what the policy should govern (which agents, which actions, which resources)
- Identify the pattern from the list above
- Write the Cedar policy
- Save to
policies/ directory
- If symbi is available, validate with
symbi dsl parse to check syntax