Skip to main content

verdictan policy lint

Before you publish it, validate a runtime policy configuration or an ABAC policy bundle. Runtime mode applies the declarative configuration schema and semantic checks. ABAC mode validates policy statements.

Usage​

verdictan policy lint [--file <path>] [--mode auto|runtime|abac]

Options​

FlagDescription
--file <path>File to validate. Defaults to policy-config.yaml.
--mode <mode>auto (default), runtime, or abac. Auto detects ABAC bundles. If there is no ABAC bundle, it uses runtime validation.

Examples​

Correct configuration​

verdictan policy lint --file policy-config.yaml

When the command succeeds, it writes no output and exits with code 0.

Invalid configuration​

verdictan policy lint --file bad-config.yaml

The command writes deterministic diagnostics to stderr and ends with policy lint failed (<count> error(s)). Validation failures are user errors and exit with code 2.

What lint checks​

CheckDescription
Schema validationYAML parses correctly and matches specified structure
Unknown top-level keysRejects keys that are not part of the documented declarative schema
Unknown policy kind valuesThe linter recognizes each value in chain
Unknown fieldsKeys in policy.<kind> must match schema
Mandatory values and boundsChecks mandatory fields, allowed enum values, numeric bounds, and cross-field constraints
ReferencesChecks policy-chain, provider, route, tool-server, secret, and test references where the schema defines them
ABAC statementsIn ABAC mode, validates effects, actions, resources, and conditions

Example configurations​

Minimal correct config​

pack:
  name: "my-project"
  version: "0.1.0"
  enabled: true

policies:
  chain:
    - prompt-injection

Full config with providers and policies​

pack:
  name: multi-provider
  version: 0.1.0
  enabled: true

providers:
  targets:
    - id: openai-primary
      provider: openai
      model: your-openai-model
      base_url: https://api.openai.com
      secret_key_ref:
        env: VERDICTAN_OPENAI_API_KEY
    - id: azure-fallback
      provider: azure
      provider_type: azure-openai
      format: openai
      model: your-azure-openai-model
      base_url: https://replace-with-resource-name.openai.azure.com
      secret_key_ref:
        env: VERDICTAN_AZURE_OPENAI_API_KEY
      azure_api_version: your-supported-api-version
      azure_deployment: your-azure-deployment

  routing:
    strategy: ordered

policies:
  chain:
    - prompt-injection
    - pii-detector

Before you start the gateway, replace the model placeholders with IDs supported by the configured provider accounts.

Provider fallback override fields are not accepted in YAML. Multiple eligible targets can cause cross-target attempts for supported failure classes. These attempts can increase cost or duplicate side effects. If a config must stop on the first eligible target, use providers.routing.allow_fallbacks: false. Review Providers Configuration before you enable multi-target routing.

Next steps​