Agentic Data Plane
Preview

rpk ai policy create

Create a Cedar authorization policy: the allow/deny gate that decides WHETHER a principal may call a tool.

The Cedar body must contain exactly one statement; scope the resource to your MCP server, for example, :

permit(principal, action == Action::"dataplane_adp_mcpserver_tools_call", resource == McpServer::`servicenow`);

Data shaping (masking, dropping, row filtering) is NOT configured here. It lives on the MCP server’s data policies (rpk ai mcp …​), not in Cedar text; the @redact_mask / @redact_drop annotations are gone.

Usage

rpk ai policy create [flags]

Global flags

Value Type Description

--config

string

Redpanda or rpk config file; default search paths are ~/.config/rpk/rpk.yaml, $PWD/redpanda.yaml, and /etc/redpanda/redpanda.yaml.

-X, --config-opt

stringArray

Override rpk configuration settings; -X help for detail or -X list for terser detail.

--ignore-profile

bool

Ignore rpk.yaml and redpanda.yaml; use default settings.

--profile

string

rpk profile to use.

-v, --verbose

bool

Enable verbose logging.