Skip to main content

Access Policies

A policy connects a subject to roles in a scope. It's the bridge between who you are and what you can do.

How it works​

Create a policy. Assign roles. The evaluator resolves all policies for a subject automatically — you never query policies at runtime.

Time-bounded grants​

Set validFrom and expiresAt to grant temporary access. The policy expires automatically — no cron job, no cleanup script.

Creating a policy​

cURL

curl -X POST https://api.wardenauthz.com/v1/scope/workspace-eng/access-policy \
  -H "x-api-key: YOUR_MANAGEMENT_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "subjectId": "subject-alice",
    "scopeId": "workspace-eng",
    "roleIds": ["editor"],
    "validFrom": "2026-02-15T00:00:00Z",
    "expiresAt": "2026-05-15T00:00:00Z"
  }'
{
  "subjectId": "subject-alice",
  "scopeId": "workspace-eng",
  "roleIds": ["editor"],
  "validFrom": "2026-02-15T00:00:00Z",
  "expiresAt": "2026-05-15T00:00:00Z"
}

TypeScript

await warden.accessPolicies.create('workspace-eng', {
  subjectId: 'subject-alice',
  roleIds: ['editor'],
  validFrom: '2026-02-15T00:00:00Z',
  expiresAt: '2026-05-15T00:00:00Z',
})

Inheritance​

Mark a policy as inheritable: true to propagate it to child scopes. A policy at the org level can grant roles in every workspace. Child scopes opt out with allowRoleInheritance: false.

Edge cases​

  • Before validFrom: The policy is ignored by the evaluator. No error — the subject simply doesn't have those roles yet.
  • After expiresAt: The policy expires with zero latency. The subject loses the roles immediately. No manual cleanup.
  • Deny wins: If one policy grants documents:write and another denies it, the deny wins. Order of policies doesn't matter.

In the dashboard​

[Screenshot: Policy list showing subject, assigned roles, and time bounds]

Navigate to Access Policies. Click New Access Policy, select a subject, pick roles, optionally set a time window and inheritance flag.