sanctum policy

Manage access policies.

Subcommands

Create a new access policy.

sanctum policy add <name> \
  --principal "agent:<pattern>" \
  --resources "<glob>,<glob>" \
  --actions <action>[,<action>] \
  --max-ttl <seconds>

sanctum policy add cursor-access \
  --principal "agent:cursor-agent" \
  --resources "openai/*,anthropic/*" \
  --actions retrieve \
  --max-ttl 300

✅ Policy 'cursor-access' created
   Principal: agent:cursor-agent
   Resources: openai/*, anthropic/*
   Actions: retrieve
   Max TTL: 300s

List all policies.

sanctum policy list

Delete a policy.

sanctum policy remove <name>

Test a policy decision without making a real request.

sanctum policy simulate \
  --agent <name> \
  --resource <path> \
  --action <action>

sanctum policy simulate \
  --agent cursor-agent \
  --resource openai/api_key \
  --action retrieve

✅ ALLOWED by policy 'cursor-access'
   Lease TTL: 300s

Field	Description
`name`	Unique policy identifier
`principal`	Agent pattern (glob): `agent:cursor-*`
`resources`	Credential path patterns (glob, comma-separated)
`actions`	`retrieve`, `list`, `store`, `delete`
`max-ttl`	Maximum lease duration in seconds