Agentic Data Plane
Preview

rpk ai policy create

Create a Cedar authorization policy: the allow/deny gate that decides WHETHER a principal may call a tool.

The Cedar body must contain exactly one statement; scope the resource to your MCP server, for example:

permit(principal, action == Action::"dataplane_adp_mcpserver_tools_call",
       resource == McpServer::"servicenow");

Data shaping (masking, dropping, row filtering) is NOT configured here. It lives on the MCP server’s data policies (rpk ai mcp …​), not in Cedar text; the @redact_mask / @redact_drop annotations are gone.

This command was introduced in ai version 0.2.26.

Usage

rpk ai policy create [flags]

Flags

Value Type Description

--cedar

string

inline Cedar policy text. Mutually exclusive with --cedar-file.

--cedar-file

string

path to a file containing the Cedar policy text (.cedar). Mutually exclusive with --cedar.

--description

string

human-readable description.

--display-name

string

human-readable display name.

--name

string

policy id (required; lowercase letters, numbers, hyphens).

Global flags

Value Type Description

--config

string

Redpanda or rpk config file; default search paths are ~/.config/rpk/rpk.yaml, $PWD/redpanda.yaml, and /etc/redpanda/redpanda.yaml.

-X, --config-opt

stringArray

Override rpk configuration settings; -X help for detail or -X list for terser detail.

--ignore-profile

bool

Ignore rpk.yaml and redpanda.yaml; use default settings.

--profile

string

rpk profile to use.

-v, --verbose

bool

Enable verbose logging.