Skip to content

Publishing Policies

Verdict Server separates your access control rules from your application code. Publishing a .vd policy updates how Verdict evaluates permissions immediately without redeploying your backend services.

The commands in this guide run against a configured Verdict Server; see Running Verdict Server to start an instance or Configuring CLI Targets to point the CLI at a local, staging, or CI environment.

Checking policies before publishing

Section titled “Checking policies before publishing”

Before uploading a policy to a server, run local checks to catch syntax errors, type mismatches, and broken access assumptions:

verdict validate policy.vd
verdict test policy.vd
  • verdict validate: Checks supported syntax and semantic rules and reports advisory lint diagnostics.
  • verdict test: Executes your inline policy tests to verify intended access boundaries.

You can also run verdict fmt to keep policy files consistently formatted (verdict fmt --write policy.vd to format in place, or verdict fmt --check policy.vd in CI).

See Testing & Validating Policies for details on writing inline test blocks and static validation rules.

Publishing the policy

Section titled “Publishing the policy”

Once your policy passes local validation and tests, publish it to Verdict Server with verdict policy publish:

verdict policy publish policy.vd
Policy published from policy.vd.

When you publish a policy, Verdict Server applies the update with three runtime guarantees:

  • Atomic compilation before replacement: The server parses, validates, and compiles the uploaded policy before replacing the active program. If compilation fails, the upload is rejected and the existing policy remains active.
  • Fact store is preserved: Publishing replaces the active compiled rules without clearing or modifying the facts stored in the server’s database.
  • Inline tests are not evaluated: test blocks remain in the stored source but are excluded from the active compiled rules.

Verifying the live deployment

Section titled “Verifying the live deployment”

After publishing, you can confirm that the server loaded the policy and evaluates requests as expected using three basic commands:

  1. Check server health and policy state with verdict status:

    verdict status
    Server: ok
    Policy: loaded

  2. Inspect the active policy source on the server with verdict policy get:

    verdict policy get

    To retrieve the source as a JSON object, use verdict policy get --json.

  3. Run a live authorization check against the server with verdict authorize:

    verdict authorize User:alice read Document:handbook

Next steps

Section titled “Next steps”