terraform-provider-stackgen

sg_policy (Resource)

⚠️ Experimental — This resource is part of the Guild platform and may change in future releases.

Manages a governance policy written in Rego. Policies can be attached to agents via sg_agent_policy_attachment to control tool execution.

Create-time 409 adoption is controlled by the provider attribute adopt_on_conflict (default true).

Example Usage

# When to use: Author a Rego governance policy (tool_call, etc.) before attaching
# it to agents with sg_agent_policy_attachment. Keep policy names stable — agents
# reference policy_id (UUID), not name.
#
# Related: sg_agent_policy_attachment, sg_policy_bundle, data.sg_policies.
resource "sg_policy" "example" {
  name        = "deny-dangerous-tools"
  description = "Blocks high-risk tool invocations."
  type        = "tool_call"

  rego_source = <<-REGO
    package guild.policy

    import rego.v1

    default decision := "allow"

    decision := "deny" if {
      input.tool in {"rm_rf", "drop_database"}
    }
  REGO
}

Import

Import an existing sg_policy using its policy ID:

terraform import sg_policy.example '123e4567-e89b-12d3-a456-426614174000'

Schema

Required

• name (String) Policy name. Must be unique.,validname
• rego_source (String) Rego source code for the policy.
• type (String) Policy type (e.g. tool_call).

Optional

• description (String) Human-readable description of the policy.

Read-Only

• id (String) Policy UUID (server-assigned).