chio policy

Test a policy against a table of expected decisions, explain what it compiles to, and check how it narrows the grants issued under it.

On this page

All command families · Global flags

chio policy

Analyze HushSpec policy rules and admission refinement.

Command synopsistext

chio policy [OPTIONS] <COMMAND>

chio policy analyze Analyze policy rules and compare admission refinement.
chio policy test Run a table of cases against a policy and its guards, and fail when any decision differs from the expected one.
chio policy explain Print what a policy compiles to, or how it decides one call.

Example

Run the case table beside the pricing project’s policy. A changed decision fails the run.

Terminalbash

chio policy test

Output

policy   ./policy.yaml
PASS  fixer reads the pricing source   allow
PASS  fixer reads /secrets/.env        deny   outside the grant
PASS  fixer edits a test               deny   rule tests-are-evidence
3 cases: 3 passed

chio policy analyze

Analyze policy rules and compare admission refinement.

Command synopsistext

chio policy analyze [OPTIONS] <POLICY>

<POLICY> Effective policy to analyze. Required.
--against <AGAINST> Older policy that the analyzed policy must narrow.
--fail-on <FAIL_ON> Lowest finding severity that produces exit code 1. Default warning. Values notice, warning, error.
--format <FORMAT> Analysis report output format. Values human, json.
--max-atoms <MAX_ATOMS> Maximum authored atoms accepted before analysis fails closed. Default 10000.

chio policy test

Run a table of cases against a policy and its guards, and fail when any decision differs from the expected one.

Command synopsistext

chio policy test [OPTIONS] [CASES]...

[CASES]... Case files. Defaults to policy.test.yaml in the current directory.
--policy <POLICY> Policy to test instead of the one the case file names.
--case <TEXT> Run only the cases whose name contains this text. Repeat for several.
--receipts <DIR> Write each case’s signed receipt to this directory.
--junit <FILE> Also write the results as JUnit XML for CI.
--mutate Weaken the policy one rule at a time (drop a pattern, widen a limit, remove a guard) and rerun every case against each weakening. Exit 1 when a weakening changes no case’s decision, naming the rule no case covers.

Additional behavior

Each case names a call (server, tool, parameters, and an optional tool output for output guards) and the decision it must get: allow, deny, pending, or redact, optionally with the guard or error code that must decide it. Cases run in a fresh admission state with no network. Exit 0 when every case matches, 1 when any differs, 2 when the case file is invalid.

chio policy explain

Print what a policy compiles to, or how it decides one call.

Command synopsistext

chio policy explain [OPTIONS] <POLICY>

<POLICY> Policy file. Required.
--server <SERVER> Server of the call to explain.
--tool <TOOL> Tool of the call to explain.
--params <PARAMS> Parameters of the call, as JSON.
--output <OUTPUT> Tool output to run the output guards against, as JSON.

Additional behavior

Without a call: the resolved extends chain, the default grants, the request guards in evaluation order, the output guards, approvals, and budgets. With --tool: each guard’s verdict for that call in order, where evaluation stopped, and the final decision. Nothing is admitted and no receipt is written.