Synopsis
--context trail=flow/trail“, repeated once per
trail. Trails named in one command are all evaluated at the same instant.
Name the policy with one of:
--identifier: a rego policy published to Kosli. Its current version, the highest-numbered valid one, is evaluated, and the evaluation cites that version. Append@vn“, as inpr-approved@v2, to evaluate version n instead, which must be valid; publishing a newer version does not change what it runs.--path: the policy’s files on this machine, sent with the evaluation.
--path takes a Rego file or a directory, and can be given more than once,
so a policy and a shared library are sent together from wherever each is kept.
Every --path joins one bundle. A file is keyed by its own name, and a file
in a directory by its path relative to that directory. Files in dot-directories,
such as .git, are left out; every other file travels, so notes such as
README.md stay with the policy.
Of what travels, the evaluator loads only:
- Rego modules:
*.rego, other than tests (*_test.rego). Modules import each other by package, so where each file sits does not matter. - Data files:
data.json,data.yaml,data.yml,*.ergo.yamland*.ergo.yml. Each is read intodataat its directory’s path in the bundle, socontrols/x/data.yamlbecomesdata.controls.x. A data file cannot writedata.params, which belongs to--params. Every other file is carried but not read.
--path given wins, and the copy left behind is named on stderr.
The policy package is the one that declares allow; every other package is a
library. Where several packages declare allow, annotate an entrypoint in exactly
one of them to say which is the policy. In the policy package:
allowis always evaluated, whether annotated or not. It must be a boolean for every input, so give it a default (default allow := false): an undefinedallowfails the evaluation rather than denying.- Every rule annotated with
# METADATAand# entrypoint: trueis evaluated too, and returned under its rule name inresult.outputs, such asviolationsorreport. A rule undefined for this input is left out. - Every other rule is evaluated only as far as those rules need it. An entrypoint annotated outside the policy package, or on a function, is refused.
--control to record the outcome as a decision against that control, in the
--flow and --trail given. The decision is recorded where the policy runs, so
the verdict is never asserted from here. Without --control nothing is recorded.
Only a published policy can record a decision, so --control needs --identifier.
Use --params to pass values the policy reads as data.params. For a
published policy, they must match the params schema of the version evaluated.
Pass --assert to exit with a non-zero status when the policy denies.
The policy that ran is printed with the verdict: a published policy by its
identifier, version and digest, and an inline one by its digest.
Use --output json to print the evaluation as Kosli returns it.
Flags
Flags inherited from parent commands
Examples Use Cases
These examples all assume that the flags--api-token, --org, --host, (and --flow, --trail when required), are set/provided.
evaluate a policy against a trail
evaluate a policy against a trail
evaluate the current version of a published rego policy against a trail
evaluate the current version of a published rego policy against a trail
evaluate version 2 of a published rego policy, whatever its current version
evaluate version 2 of a published rego policy, whatever its current version
evaluate several trails at one instant
evaluate several trails at one instant
evaluate a policy with parameters (inline JSON or @file.json)
evaluate a policy with parameters (inline JSON or @file.json)
evaluate a published policy and record the outcome as a decision
evaluate a published policy and record the outcome as a decision
evaluate a policy and fail the step when it denies
evaluate a policy and fail the step when it denies