Search the documentation
Search the documentation...
SplitSecure documentation

On this page

Procedure · 2 steps

Write a policy

The policy language: name people and groups, combine them, ask in order or escalate on a timer, then save the policy and give its name to the developer.

Updated

Before you start

A policy decides who must approve, in what combination, and within what time. For example, Acme can require the IT lead and one member of the security group before a laptop wipe.

The policy language

A policy is one expression. The hub reads it from the outside in and asks the people it names. The request is approved when the expression is satisfied, and denied when no path can succeed any more.

Name who approves

Form Meaning
(person "[email protected]") The person with this email approves.
(group "name") Any one member of the group approves.
(group "name" 3) Three distinct members of the group approve.
(group "name" "pool") A group from an identity pool, named with its pool.
(initiating-party) The person or group that started the request approves. If the hub finds nobody to ask, this step passes.
(policy "name") The named policy is satisfied. The name is a def-policy in the same source, or a stored policy of the organization.
(person-id "s2r"), (group-id "s2r"), (policy-id "s2r") The same, by id. An id keeps pointing at the entity after a rename. Copy on the member’s page, the group row or the policy row gives it.

When you save, the hub also stores a copy of the policy with every name and email pinned to its id form. Your source stays as you typed it. A reference that does not resolve refuses the save.

Combine approvers

Form Meaning
(or expr...) At least one child is satisfied.
(and expr...) Every child is satisfied.
(any N expr...) At least N of the children are satisfied.
(at-least N expr) The expression is satisfied, and at least N different people approved inside it. A person who satisfies several branches counts once.
(seq expr...) Every child is satisfied, in order. The hub asks the next child only after the previous one is satisfied.
(timeout "10m" now after) The now child can be satisfied at any time. After the duration passes, the after child can be satisfied too. The clock starts when the hub first asks this part.
(def-policy "name" expr) Gives a name to an expression, at the top level of the source. (policy "name") refers to it.

A deny makes its branch unsatisfiable. The request is denied when no path can succeed.

Examples

Any member of group a approves, or one named person:

(or (group "a") (person "[email protected]"))

Three members of group a or one named person, and in both cases a second person:

(and
  (or (group "a" 3) (person "[email protected]"))
  (person "[email protected]"))

Ask one person first, and the others only after that person approves:

(seq
  (person "[email protected]")
  (or (group "a" 3) (person "[email protected]")))

Page the on-call person, and let any manager approve after ten minutes:

(timeout "10m"
  (person "[email protected]")
  (group "managers"))

Two different people, even when one person could satisfy both parts:

(at-least 2
  (and (group "b") (person "[email protected]")))

A named branch reused by the main expression:

(def-policy "risk-review"
  (or (group "a" 3) (person "[email protected]")))

(and (policy "risk-review") (person "[email protected]"))

The person who started the request, plus a manager:

(and (initiating-party) (group "managers"))

Save the policy

In the Web App

Create the policy

  1. In the sidebar, click StepAuth → Policies.
  2. Click Create policy.
  3. In Policy name (unique, permanent), enter a name, for example laptop-wipe.
  4. Write the policy in the editor. The Reference tab lists the forms of the policy language.
  5. Click Save.

A name has 120 characters or fewer, and you cannot rename a policy later. An organization has 200 policies or fewer.

Give the name to the developer

The developer passes the policy name, laptop-wipe, to the policy helper of the SDK. The hub directory also lists the names of the policies. The Copy policy S2R control on the row copies the id that other policies reference. A request does not use it.