autonomy policy

Manage policy bundles

Options inherited from parent commands

      --require-signed-manifest   Refuse to start if the SHA256SUMS release manifest or its cosign signature is missing/invalid (Tier 2 binary-integrity check; default: build-time compile-in via -ldflags -X, build-hardened artifacts=true, all others=false)

Subcommands

• autonomy policy build — Build a policy bundle .tar.gz from a directory of .rego files

• autonomy policy cache — Inspect the local policy bundle cache

• autonomy policy compile-graph — Compile a graph-format approval-chain policy into Rego (writes data.autonomy)

• autonomy policy compile-json — Compile a JSON rule list into Rego (writes data.autonomy)

• autonomy policy compile-yaml — Compile a YAML DSL policy into Rego (writes data.autonomy)

• autonomy policy eval — Evaluate an action against a local policy bundle (SIL harness use)

• autonomy policy fetch — Fetch a policy bundle from an OCI registry and cache it locally

• autonomy policy inspect — Inspect a policy bundle (.tar.gz, directory, or built-in)

• autonomy policy load — Load a policy bundle .tar.gz into the local cache with runtime compatibility check

• autonomy policy status — Show current and LKG (last-known-good) policy bundle slot metadata