Deploy a Policy

Install a policy pack for your tenant with the CLI or the API so your authority decisions reflect your rules — plus how the full draft, review, and rollback lifecycle works.

intermediate4 min readimplemented

Deploy a Policy#

Policy is what turns a proposed action into an APPROVED, ESCALATED, or DENIED decision. The fastest way to make policy live for a tenant is to install a policy pack — a curated, versioned bundle of rules. This guide installs one with the CLI (the deploy-policy command) and the API (POST /policy-packs/install), then confirms it took effect.

Two layers of policy

Policy packs are pre-built rule bundles you install as a unit — what this guide covers, and what ships in the CLI today. Custom policy authoring (drafting individual rules, submitting them for review, approving, and rolling back versions) runs through the Policies API and the Console. The CLI does not have a draft → review → approve → deploy → rollback command group; see Lifecycle below.

Browse the catalog#

The shipped packs are curated rule bundles. List the catalog to see what is available:

bash

curl "https://api.intended.so/policy-packs?tenant_id=$INTENDED_TENANT_ID" \
  -H "Authorization: Bearer $INTENDED_API_KEY"

bash

# Or from the CLI:
intended policy-pack-inspect --apikey "$INTENDED_API_KEY" --tenant "$INTENDED_TENANT_ID"

Packs available in the catalog today include:

Pack name (`--pack`)	Focus
`soc2`	SOC 2-style operational controls
`security`	General security guardrails
`finance`	Finance operations
`financial-services`	Financial-services controls
`healthcare-hipaa`	HIPAA-aligned handling
`code-modification-guardrails`	Guardrails on agent code changes
`customer-data-egress`	Controls on customer-data movement
`robotics-safety`	Physical-AI safety rules
`multi-robot-coordination`	Multi-robot coordination safety

Packs provide mechanisms, not certifications

A pack named soc2 or healthcare-hipaa encodes useful rules; it does not make your deployment certified or compliant with that framework. Intended provides the enforcement and audit mechanisms — the compliance attestation is yours to obtain.

Steps#

Pick a pack

Choose a pack name from the catalog above. The pack must exist, or the install returns 404 POLICY_PACK_NOT_FOUND.

Install it for your tenant

deploy-policy (alias policy-pack-install) installs the pack via POST /policy-packs/install. The tenant_id comes from your verified credential (or the body / x-tenant-id header) and must match it.

bash

curl -X POST https://api.intended.so/policy-packs/install \
  -H "Authorization: Bearer $INTENDED_API_KEY" \
  -H "x-tenant-id: $INTENDED_TENANT_ID" \
  -H "Content-Type: application/json" \
  -d '{
    "pack": "code-modification-guardrails",
    "tenant_id": "tenant_acme_prod"
  }'

From the CLI:

bash

intended deploy-policy \
  --apikey "$INTENDED_API_KEY" \
  --tenant "$INTENDED_TENANT_ID" \
  --pack code-modification-guardrails

A successful install returns the installed bundle and a count:

json

{
  "tenant_id": "tenant_acme_prod",
  "installed_pack": { "name": "code-modification-guardrails", "rules": [ … ] },
  "installed_count": 7,
  "installed": [ … ]
}

Confirm it is live

List what is installed for the tenant to confirm:

bash

curl "https://api.intended.so/policy-packs/installed" \
  -H "Authorization: Bearer $INTENDED_API_KEY" \
  -H "x-tenant-id: $INTENDED_TENANT_ID"

Then submit a representative intent (see Quickstart) and confirm the decision and rationale reflect the pack's rules.

Install errors#

Status	Code	Cause
400	`INVALID_POLICY_PACK_REQUEST`	Body failed schema validation (missing/empty `pack`)
400	`TENANT_REQUIRED`	No `tenant_id` in body and no `x-tenant-id` header
404	`POLICY_PACK_NOT_FOUND`	The named pack is not in the catalog

The full policy lifecycle#

Installing a pack is one path. Authoring and governing custom policy — drafting individual rules, reviewing, approving, deploying a version, and rolling back — is a multi-step lifecycle that runs through the Policies API and the Console, not the CLI.

Roadmap: CLI lifecycle verbs

There is no intended policy … command group, and dedicated CLI verbs for draft, review, approve, and rollback are Roadmap. Until they ship, manage the authoring lifecycle through the Console or the Policies API directly.

See the Policies API for the draft, review, approval, deployment, and rollback endpoints.

Next steps#

Policies API — the full authoring and lifecycle contract
Quickstart — submit an intent and watch policy take effect
Roles and Token Governance — who may install and approve policy