ironflow policy

Manage authorization policies.

ironflow policy <subcommand> [flags]

Policies define subtractive deny rules with actions, resource IRN patterns, and optional CEL conditions. Per ADR 0016 / #943, effect="deny" is the only accepted value at write — the legacy allow path was inert at evaluation and is now rejected with 400. RBAC roles (Layer 1) grant capabilities; these policies (Layer 2) narrow them. See Custom Roles & CEL Policies for full details.

Self-lockout bypass

The --bypass-self-lockout-preflight flag on policy create / policy update is a break-glass control. Per ADR 0016 it requires an ifplatform_ API key, and bypassed writes are still audited. Do not include secrets in --bypass-reason — the value is forwarded as an HTTP header and printed to stderr.

ironflow policy create

Create a new authorization policy.

ironflow policy create [flags]

Flags:

Flag	Short	Type	Default	Description
--name		string		Policy name (required)
--effect		string		deny only (required; allow is rejected with 400 — #943, ADR 0016 T2)
--actions		string		Comma-separated action patterns (required)
--resources		string		Comma-separated IRN resource patterns (required)
--condition		string		CEL condition expression (optional)
--bypass-self-lockout-preflight		bool	false	Skip the self-lockout preflight (break-glass; audited)
--bypass-reason		string		Required when --bypass-self-lockout-preflight is set
--server	-s	string		Server URL override

Output:

Created policy: deny-prod-delete (id: pol_x1y2z3)

ironflow policy list

List all policies, optionally filtered by organization.

ironflow policy list [flags]

Flags:

Flag	Short	Type	Default	Description
--org		string		Filter by organization
--json		bool	false	Output as JSON
--server	-s	string		Server URL override

Output:

ID           NAME              EFFECT  ACTIONS                              RESOURCES
pol_x1y2z3   deny-prod-delete  deny    secrets:manage,apikeys:manage        irn:ironflow:*:*:*:env_prod:*
pol_a4b5c6   deny-prod-writes  deny    functions:register,functions:invoke  irn:ironflow:*:*:*:env_prod:*

ironflow policy get

Get detailed information about a policy.

ironflow policy get <id> [flags]

Arguments:

Argument	Required	Description
id	Yes	Policy ID

Flags:

Flag	Short	Type	Default	Description
--json		bool	false	Output as JSON
--server	-s	string		Server URL override

Output:

ID:        pol_x1y2z3
Name:      deny-prod-delete
Effect:    deny
Actions:   secrets:manage,apikeys:manage
Resources: irn:ironflow:*:*:*:env_prod:*
Condition: request.environment == "env_prod"

ironflow policy update

Patch fields on an existing policy. Only flags you provide are sent to the server.

ironflow policy update <id> [flags]

Arguments:

Argument	Required	Description
id	Yes	Policy ID

Flags:

Flag	Short	Type	Default	Description
--name		string		New name
--effect		string		New effect: deny only (#943, ADR 0016 T2). PATCH allow→deny on legacy rows is the admin fix path; setting effect=allow is rejected with 400.
--actions		string		New comma-separated actions
--resources		string		New comma-separated resource IRNs
--condition		string		New CEL condition
--clear-condition		bool	false	Clear the existing CEL condition (sends empty string)
--bypass-self-lockout-preflight		bool	false	Skip the self-lockout preflight (break-glass; audited)
--bypass-reason		string		Required when --bypass-self-lockout-preflight is set
--server	-s	string		Server URL override

ironflow policy delete

Delete a policy by its ID.

ironflow policy delete <id> [flags]

Arguments:

Argument	Required	Description
id	Yes	Policy ID

Flags:

Flag	Short	Type	Default	Description
--server	-s	string		Server URL override

Output:

Policy deleted

ironflow policy test

Compile and evaluate a CEL condition (saved or inline) against caller-supplied request and subject activation maps. Nothing is persisted; mirrors POST /api/v1/policies/dry-run.

ironflow policy test [flags]

Flags:

Flag	Short	Type	Default	Description
--policy-id		string		Saved policy ID whose condition to test
--condition		string		Inline CEL condition to test (overrides saved condition)
--request		string		Request activation map as inline JSON
--subject		string		Subject activation map as inline JSON
--request-file		string		Path to request activation JSON file
--subject-file		string		Path to subject activation JSON file
--json		bool	false	Output as JSON
--server	-s	string		Server URL override

Either --policy-id or --condition is required. Inline JSON wins when both inline and file flags are passed.

Output:

Condition: subject.org == "acme"
Matched: true

ironflow policy versions list

Show full version history for a policy, newest first. Each row is a full snapshot for client-side diffing.

ironflow policy versions list <policy_id> [flags]

Flags:

Flag	Short	Type	Default	Description
--json		bool	false	Output as JSON
--server	-s	string		Server URL override

ironflow policy rollback

Forward-save a prior version’s snapshot as a new version. History is append-only — rollback never rewrites past rows.

ironflow policy rollback <policy_id> <version> [flags]

Flags:

Flag	Short	Type	Default	Description
--server	-s	string		Server URL override

ironflow policy template list

List installable policy templates visible to your tenant: tenant-private bundles plus platform-published bundles.

ironflow policy template list [flags]

Flags:

Flag	Short	Type	Default	Description
--json		bool	false	Output as JSON
--server	-s	string		Server URL override

ironflow policy template install

Install a template bundle into your org. Validation runs against every spec; one bad condition or name collision rejects the whole install (no partial bundles).

ironflow policy template install <template_id> [flags]

Flags:

Flag	Short	Type	Default	Description
--server	-s	string		Server URL override

Examples:

# Deny destructive ops in production unconditionally
ironflow policy create --name deny-prod-destructive --effect deny \
  --actions "secrets:manage,apikeys:manage,projections:manage" \
  --resources "irn:ironflow:*:*:*:env_prod:*"

# Deny writes in production
ironflow policy create --name deny-prod-writes --effect deny \
  --actions "functions:register,functions:invoke,events:emit" \
  --resources "irn:ironflow:*:*:*:env_prod:*"

# Deny staging access for non-oncall callers (CEL condition on subject.roles)
ironflow policy create --name deny-staging-non-oncall --effect deny \
  --actions "*" --resources "irn:ironflow:*:*:*:env_staging:*" \
  --condition '!("oncall" in subject.roles)'

# List all policies
ironflow policy list
ironflow policy list --org org_default --json

# Update a policy's condition
ironflow policy update pol_x1y2z3 --condition "subject.org == 'acme'"

# Test a policy condition without saving
ironflow policy test --policy-id pol_x1y2z3 \
  --request '{"action":"read"}' \
  --subject '{"id":"u1","roles":["admin"]}'

# Browse and roll back versions
ironflow policy versions list pol_x1y2z3
ironflow policy rollback pol_x1y2z3 2

# Install a template bundle
ironflow policy template list
ironflow policy template install tpl_admin_basics

# Break-glass: bypass the self-lockout preflight (audited)
ironflow policy update pol_x1y2z3 --effect deny \
  --bypass-self-lockout-preflight \
  --bypass-reason "incident-217 emergency lockout recovery"

# Delete a policy
ironflow policy delete pol_x1y2z3

---