Skip to content

Define a constraint policy for grants

Create, change or delete a reusable set of conditions that limits how capability grants may be used: when, on which days and hours, how many times, how often, and whether only once.

Who can do it

A tenant administrator or a tenant key manager. Creating, editing and deleting a policy are separate permissions; the console shows New constraint policy, Edit and Delete only to a person who holds the matching one.

This is for tenants that compose authorization by hand. A SIMPLE tenant uses Internal Use Cases instead, and the platform refuses these changes for it.

Before you start

  • A policy restricts nothing on its own: it takes effect through the grants pinned to one of its versions.
  • Usage counts are kept per grant. Two grants under the same policy each get their own allowance.
  • Days and hours are read in the platform time zone, which a platform administrator sets.

Steps

  1. Open Constraint Policies from the tenant sidebar.
  2. To create a policy, select New constraint policy:
    1. Enter a Name and, optionally, a Description.
    2. Set the conditions you need. Every condition is optional, and a use must satisfy all of them:
      • Valid From and Valid Until: the window in which a grant works, in your display time zone; either side can stay open.
      • Schedule: tick Admit requests only on chosen days and hours, then choose the Days and the hours From and Until.
      • Max Usage: how many uses each grant is allowed. Blank means unlimited.
      • Rate Limit: uses per minute for each grant. Blank means no limit; 0 blocks every use.
      • Revoke on use: the first use consumes the grant.
    3. Select Create.
  3. To change a policy, select it, select Edit on its Info tab, change the fields, and select Save Changes.
  4. To delete a policy, select it, select Delete on its Info tab, and confirm with Delete.

What you see when it worked

  • Create: the console confirms that the policy was created. It is listed at version 1, and the grant wizard offers it.
  • Edit: the console confirms that the policy was updated. Saving writes the next version; the Version column shows it, and the Versions tab lists every version. An edit moves no grant: a grant keeps the version it was pinned to until it is re-pinned with Change version.
  • Delete: the console confirms that the policy was deleted. A deleted policy cannot be restored.

Every change is recorded in the audit trail; the policy's Activity tab shows it.

If it fails

What you see Cause What to do
Deleting is refused, naming the grants that hold the policy A capability grant or cryptographic exchange still references it Revoke those grants or re-pin them to another policy, then delete
The validity window is refused Valid Until is not after Valid From Correct the dates
A negative Max Usage or Rate Limit is refused Both must be zero or more Enter zero or more, or leave the field blank
"Choose at least one day." A schedule names no day Choose the days, or untick the schedule
"Enter both a start and an end time." A schedule has only one of its times Enter both times
"The start and the end must differ." The schedule starts and ends at the same time Change one of them. An end earlier than the start runs into the next day
"Failed to save policy" The server refused the policy without a detail the console can show Check the conditions and retry

Without the console

Surface How
Key management CLI ankasecure-km constraint-policies create --body-file <json>, ankasecure-km constraint-policies update --id <uuid> --body-file <json> and ankasecure-km constraint-policies delete --id <uuid>
Admin SDK ConstraintPolicyOperations.create(CreateConstraintPolicyRequest), update(UUID, CreateConstraintPolicyRequest) and delete(UUID)
API POST /api/v3/admin/tenants/{tenantId}/constraint-policies (operation createConstraintPolicy)
API PATCH /api/v3/admin/tenants/{tenantId}/constraint-policies/{policyId} (operation updateConstraintPolicy)
API DELETE /api/v3/admin/tenants/{tenantId}/constraint-policies/{policyId} (operation deleteConstraintPolicy)