bijection policy
An owner policy enrolls tables by stable identity and bounds where their information may go: copies to other tables, scheduled work, command sends, results handed to actions and deletion of the table are refused unless the policy permits them. Enrolling program parts (as CODEOWNERS names paths) labels that program: every amendment of it, each publication included, also needs the owner's own approvers.
A program policy protects one target, live or a branch: it names who may propose a program for it, who approves one and how many approvals publication needs. Without one the target is unprotected; with one, merges go through reviewed pull requests (bijection pr). Its id is program-live for live.
A change is proposed as a candidate, approved by a quorum of the governing policy's approvers (never its proposer) and installed by one of its proposers. The first installation is decided by the candidate's own rule and needs deployment administration (--admin-key), so it names deployment-admin as a proposer.
An owner policy file is {"id": "payroll", "component": null, "resources": ["payroll"], "parts": [{"program": "live", "sources": "src/payroll/**"}], "destinations": [{"kind": "table", "table": "summaries"}, {"kind": "receiver", "binding": "crm", "operation": null}, {"kind": "custody", "installation": "scheduler"}], "proposers": ["deployment-admin"], "approvers": ["issuer|subject"], "quorum": 1, "fresh_authentication_ms": null, "until_ms": null}. Table names resolve in the named component (the root application by default) to the tables' current identities; no resources and no parts propose withdrawing the policy.
A program policy file is {"program": "live", "proposers": ["deployment-admin", "issuer|author"], "approvers": ["issuer|reviewer"], "quorum": 1, "fresh_authentication_ms": null}. Approvers with a quorum of 1 act as a bypass list; no approvers propose unprotecting the target.
Usage:
bijection policy [flags]
bijection policy [command]
Available Commands:
approve Approve an open candidate, echoing what you inspected
install Install an approved candidate as one of the policy's proposers
list List installed owner and program policies and their open candidates
propose Open a candidate replacing or first installing an owner or program policy
Flags:
--deployment string Manage policies on a specific deployment. Accepts:
• a deployment name (e.g. joyful-capybara-123)
• a deployment reference (e.g. dev/james, staging)
• dev (for your personal dev deployment)
• prod (for your project’s default production deployment).
You can also select deployments in other projects with project-slug:reference.
-h, --help help for policy
--help-all Show all commands and options, including administrative controls.
--help-json Print command input and output schemas as JSON without executing it.
--sign-in-client string Select the installed application client for business sign-in
--url string Manage policies on a private deployment at this explicit origin.
Use "bijection policy [command] --help" for more information about a command.
bijection policy approve
Approve an open candidate, echoing what you inspected
Usage:
bijection policy approve <id> <candidate> <assessment> [flags]
Flags:
--format string Output format; JSON preserves exact values. (pretty, json) (default "pretty")
-h, --help help for approve
--help-all Show all commands and options, including administrative controls.
--help-json Print command input and output schemas as JSON without executing it.
--step-up Re-authenticate in the browser now and approve with that fresh sign-in; required by a policy with a fresh authentication window
Global Flags:
--deployment string Manage policies on a specific deployment. Accepts:
• a deployment name (e.g. joyful-capybara-123)
• a deployment reference (e.g. dev/james, staging)
• dev (for your personal dev deployment)
• prod (for your project’s default production deployment).
You can also select deployments in other projects with project-slug:reference.
--sign-in-client string Select the installed application client for business sign-in
--url string Manage policies on a private deployment at this explicit origin.
bijection policy install
Install an approved candidate as one of the policy's proposers
Usage:
bijection policy install <id> <candidate> [flags]
Flags:
--format string Output format; JSON preserves exact values. (pretty, json) (default "pretty")
-h, --help help for install
--help-all Show all commands and options, including administrative controls.
--help-json Print command input and output schemas as JSON without executing it.
Global Flags:
--deployment string Manage policies on a specific deployment. Accepts:
• a deployment name (e.g. joyful-capybara-123)
• a deployment reference (e.g. dev/james, staging)
• dev (for your personal dev deployment)
• prod (for your project’s default production deployment).
You can also select deployments in other projects with project-slug:reference.
--sign-in-client string Select the installed application client for business sign-in
--url string Manage policies on a private deployment at this explicit origin.
bijection policy list
List installed owner and program policies and their open candidates
Usage:
bijection policy list [id] [flags]
Flags:
--format string Output format; JSON preserves exact values. (pretty, json) (default "pretty")
-h, --help help for list
--help-all Show all commands and options, including administrative controls.
--help-json Print command input and output schemas as JSON without executing it.
Global Flags:
--deployment string Manage policies on a specific deployment. Accepts:
• a deployment name (e.g. joyful-capybara-123)
• a deployment reference (e.g. dev/james, staging)
• dev (for your personal dev deployment)
• prod (for your project’s default production deployment).
You can also select deployments in other projects with project-slug:reference.
--sign-in-client string Select the installed application client for business sign-in
--url string Manage policies on a private deployment at this explicit origin.
bijection policy propose
Open a candidate replacing or first installing an owner or program policy
Usage:
bijection policy propose <policy-file> [flags]
Flags:
--format string Output format; JSON preserves exact values. (pretty, json) (default "pretty")
-h, --help help for propose
--help-all Show all commands and options, including administrative controls.
--help-json Print command input and output schemas as JSON without executing it.
Global Flags:
--deployment string Manage policies on a specific deployment. Accepts:
• a deployment name (e.g. joyful-capybara-123)
• a deployment reference (e.g. dev/james, staging)
• dev (for your personal dev deployment)
• prod (for your project’s default production deployment).
You can also select deployments in other projects with project-slug:reference.
--sign-in-client string Select the installed application client for business sign-in
--url string Manage policies on a private deployment at this explicit origin.