Policy configuration

The flat configuration hub remains the compatibility route. This page is the canonical source-checked field reference for its family, including nested tables and list rows.

Paths in the tables are relative to [policy] and its nested headings. Each row gives the serde type and source default or unset meaning. Check Cedar syntax and policy validation with gdsgate authority policy validate <PATH>; check config parsing with gdsgate doctor --config <PATH> --json. Follow the policy lifecycle guide.

[policy]

Used by: Authority.

Key	Type	Default	Purpose
path	optional string	unset, deny-all bootstrap policy	Path to a Cedar policy document Authority loads at startup. The bootstrap policy denies every action.

[policy]
path = "/etc/gdsgate/policy.cedar"

The policy is strict-validated against gdsgate's Cedar schema at load, and may be validated independently with gdsgate authority policy validate. The file seeds the store on first boot; afterwards edit the live policy remotely with gdsgate authority policy pull / push, which is hot-reloaded and gated by editPolicy. gdsgate authority policy template prints the policy to start that file from. See Policy for the schema and patterns.