---
title: "Keep policies in git"
description: "Write decisions as policy files, decide in process and explain every decision."
section: "guides"
status: "Building for 0.2"
spec: "policy"
canonical: "https://mainsdk.dev/docs/guides/keep-policies-in-git"
updated: "2026-10-28"
---

# Keep policies in git

> Write decisions as policy files, decide in process and explain every decision.

Status: Building for 0.2 · Canonical: https://mainsdk.dev/docs/guides/keep-policies-in-git · Updated: 2026-10-28

You will put policy files in your repository, decide a request in process and explain the result. It takes about 15 minutes.

## You need

- The `access` interface set up (see [Protect a route with permissions](https://mainsdk.dev/docs/guides/protect-a-route-with-permissions)).

## 1. Choose the engine

```yaml title="main.yaml"
policy:
  engine: cedar
  dir: policies/
  mode: observe
```

Start in `observe`: decisions are logged but not enforced. Move to `enforce` when the log looks right.

## 2. Decide and explain

```ts title="lib/decide.ts"
import { policy } from "mainsdk";

export function canUpdate(user: string, order: { id: string }) {
  const d = policy.decide({
    subject: { type: "user", id: user, roles: ["member"] },
    action: { name: "orders.update" },
    resource: { type: "order", id: order.id },
  });
  return { allowed: d.allow, why: policy.explain(d.id) };
}
```

## 3. Review changes in a pull request

Policy files are plain text in git, so a change to who may do what is a reviewed diff with history.

## Check it worked

`policy.explain()` names the policy and rule behind a decision, and the audit log holds the policy version.

## Next

- [Policy decisions](https://mainsdk.dev/docs/interfaces/policy)