Module policy 

Raw Rego policy management over the canonical policy/* family. … policy … — raw Rego policy management over the canonical policy/* Trust Tasks.

This is the power-user surface: hand-authored Rego, for posture the declarative approvals model cannot express. The common case — “this task needs re-authentication / needs a human to approve” — belongs to … approvals …, which writes one reserved row through this same family.

Transport-agnostic: every call goes through the SDK’s rpc_tt, so this works on a VTA that advertises only DIDComm or TSP. The step-up policy surface it replaces was REST-only in the SDK, which meant an operator on a mediator-only VTA could not read the policy that was blocking them.

Functions

cmd_delete

policy delete <id> — remove a policy module.

cmd_list

policy list — enumerate stored policy modules.

cmd_show

policy show <id> — print one policy module, Rego and all.

cmd_upsert

policy upsert — create or revise a hand-authored policy.