Early access. Policies can be created and are evaluated on every call, and every would-be denial is written to the audit log. In the current release denials are recorded rather than blocked while enforcement is rolled out per organization. Contact us at danubeai.com/contact-sales to turn enforcement on for your organization.
How evaluation works
- No policies means ungoverned. Every member keeps full access to the organization’s tools.
- The first policy switches the organization to deny-by-default. From then on, a member can only use what a policy allows.
- Explicit deny wins. If any policy denies a service or tool to a subject that includes the member, the call is denied even if another policy allows it.
- Owners and admins are exempt. They always keep full access, so a mistaken policy cannot lock the people who can fix it out.
- Scope. A service-level policy covers every tool in that service. A tool-level policy covers one tool.
Subjects
Create a policy
1
Open Policies
Go to Dashboard > Organization > Policies. Admins and owners only.
2
Pick the subject and the effect
Choose the organization, a team, or a role, and whether the policy allows or denies.
3
Pick the scope
Choose a service (all of its tools) or a single tool.
4
Check the audit log
After the first policy exists, denied calls appear in the audit log with status
denied and the reason. Use it to confirm the policy does what you intended before relying on it.Example
A support team may read and create Zendesk tickets, but nobody outside the admins may delete them:Endpoints
Validation rules: a policy needs a
service_id or a tool_id; organization-wide policies must use subject_id: "default"; role policies must name one of the four roles.