rpk ai policy create
Create a Cedar authorization policy: the allow/deny gate that decides WHETHER a principal may call a tool.
The Cedar body must contain exactly one statement; scope the resource to your MCP server, for example, :
permit(principal, action == Action::"dataplane_adp_mcpserver_tools_call",
resource == McpServer::`servicenow`);
Data shaping (masking, dropping, row filtering) is NOT configured here.
It lives on the MCP server’s data policies (rpk ai mcp …), not in Cedar
text; the @redact_mask / @redact_drop annotations are gone.
Global flags
| Value | Type | Description |
|---|---|---|
|
string |
Redpanda or |
|
stringArray |
Override |
|
bool |
Ignore |
|
string |
|
|
bool |
Enable verbose logging. |