Policy Rego Reference

Policies must declare package wardline.authz and export an allow boolean (and optionally a reason string):

package wardline.authz

default allow = false

allow {
    input.identity == "agent-abc123"
    input.tool == "read_file"
}

input is the full request context — see Policy Backends for the exact JSON shape.