rpk ai policy create
Create a Cedar authorization policy: the allow/deny gate that decides WHETHER a principal may call a tool.
The Cedar body must contain exactly one statement; scope the resource to your MCP server, for example:
permit(principal, action == Action::"dataplane_adp_mcpserver_tools_call",
resource == McpServer::"servicenow");
Data shaping (masking, dropping, row filtering) is NOT configured here.
It lives on the MCP server’s data policies (rpk ai mcp …), not in Cedar
text; the @redact_mask / @redact_drop annotations are gone.
| This command was introduced in ai version 0.2.26. |
Flags
| Value | Type | Description |
|---|---|---|
|
string |
inline Cedar policy text. Mutually exclusive with |
|
string |
path to a file containing the Cedar policy text (.cedar). Mutually exclusive with |
|
string |
human-readable description. |
|
string |
human-readable display name. |
|
string |
policy id (required; lowercase letters, numbers, hyphens). |
Global flags
| Value | Type | Description |
|---|---|---|
|
string |
Redpanda or |
|
stringArray |
Override |
|
bool |
Ignore |
|
string |
|
|
bool |
Enable verbose logging. |