# Symbi Policy

> Create, edit, or validate Cedar authorization policies for Symbiont agents. Use when defining access control rules, setting up security policies, or debugging policy evaluation.

- Skill: `ezee234/symbi-policy` (Agent Skill)
- Install (CLI): `npx skillmds@latest add ezee234/symbi-policy`
- Raw SKILL.md: https://api.skillmd.com/api/skills/ezee234/symbi-policy/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: Ezee234 (https://skillmd.com/u/ezee234)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/ezee234/symbi-policy

---


# Cedar Policy Management

Help the user create or modify Cedar policies for their Symbiont agents.

## Cedar Policy Syntax Reference

Cedar policies use `permit` and `forbid` to control access:

```cedar
// Allow an agent to read from a specific resource
permit(
    principal == Agent::"data-analyzer",
    action == Action::"read",
    resource in ResourceGroup::"public-datasets"
);

// Forbid writing PII unless the agent has HIPAA compliance
forbid(
    principal,
    action == Action::"write",
    resource
) when {
    resource.contains_pii == true
} unless {
    principal.compliance_level == "hipaa"
};
```

## Common Policy Patterns

When asked to create a policy, identify the pattern:
- **Role-based**: Different agent roles get different permissions
- **Resource-scoped**: Permissions vary by resource type/sensitivity
- **Time-bounded**: Permissions that expire or are scheduled
- **Approval-gated**: Actions requiring human approval
- **Audit-all**: Log everything, permit/deny selectively

## Workflow

1. Ask what the policy should govern (which agents, which actions, which resources)
2. Identify the pattern from the list above
3. Write the Cedar policy
4. Save to `policies/` directory
5. If symbi is available, validate with `symbi dsl parse` to check syntax