Skip to content

cli reference

Intended Documentation

Policy Commands

Install and inspect policy packs from the command line with @intended/cli — the real flat commands deploy-policy (alias policy-pack-install) and policy-pack-inspect, plus how they relate to deploy-time policy review.

beginner4 min readimplemented

Policy Commands#

@intended/cli exposes two policy-related commands: install a policy pack for a tenant, and list the packs already installed. Both are flat, hyphenated commands.

There is no `intended policy …` command group

The CLI does not have a git-style intended policy <subcommand> group (no policy drafts create, policy deploy, policy rollback, etc.). The real commands are deploy-policy (alias policy-pack-install) and policy-pack-inspect. The full draft → review → approve → deploy → rollback lifecycle is driven through the Policies API and the Console, not these CLI commands.

Commands#

CommandAPI callWhat it doesKey flags
deploy-policy (alias policy-pack-install)POST /policy-packs/installInstall a named policy pack for a tenant.--pack (required) · --tenant
policy-pack-inspectGET /policy-packs?tenant_id=…List the policy packs installed for a tenant.--tenant

Both commands print the raw JSON API response and return exit code 0 on a 2xx, 1 otherwise. They require a tenant scope and a credential — see Authentication for how the CLI resolves those.

deploy-policy

$intended deploy-policy --pack <pack> --tenant <tenant>

Install a policy pack for a tenant (alias: policy-pack-install).

--packstring *
Policy pack identifier to install (sent as `pack`).
--tenantstring
Tenant id (sent as `tenant_id`). Falls back to config / portal session.

If --pack is missing the command exits non-zero with --pack is required. The request body sent to the API is { "pack": "<pack>", "tenant_id": "<tenant>" }.

bash
intended deploy-policy \
  --apikey "$INTENDED_API_KEY" \
  --tenant tenant_acme_prod \
  --pack prod-release-controls

policy-pack-inspect

$intended policy-pack-inspect --tenant <tenant>

List the policy packs installed for a tenant.

--tenantstring
Tenant id (sent as `tenant_id` query param). Falls back to config / portal session.
bash
intended policy-pack-inspect --apikey "$INTENDED_API_KEY" --tenant tenant_acme_prod

The response lists the installed packs for the tenant. Use it after deploy-policy to confirm the pack is present before relying on it in the authority loop.

How packs relate to enforcement#

Installing a policy pack makes its rules available to the authority engine for that tenant. At decision time the engine matches rules and applies most-severe-wins (DENY > REQUIRE_APPROVAL > ESCALATE > ALLOW) with default-deny when nothing matches — installing a pack adds rules, it does not relax the default. To see how a specific intent would resolve against installed policy, use intended simulate (see the CLI reference).

Lifecycle (drafts, review, rollback) lives in the API/Console

Creating policy drafts, submitting them for review, approving, deploying a specific version, and rolling back are policy-lifecycle operations served by the Policies API and the Console policy editor — there are no CLI commands for them in v0.1.0. Treat that lifecycle as Roadmap for the CLI.

Policy Commands | Intended