{{! Copyright (c) HashiCorp, Inc. SPDX-License-Identifier: BUSL-1.1 ~}}
{{#if (eq @policyType "acl")}}

ACL Policies are written in Hashicorp Configuration Language ( HCL ) or JSON and describe which paths in Vault a user or machine is allowed to access. Here is an example policy:

{{else if (eq @policyType "rgp")}}

Role Governing Policies (RGPs) are tied to client tokens or identities which is similar to ACL policies. They use Sentinel as a language framework to enable fine-grained policy decisions.

Here is an example policy that uses RGP to restrict access to the admin policy such that a user named "James Thomas" or has the Team Lead role can manage the admin policy:

{{else}}

Endpoint Governing Policies (EGPs) are tied to particular paths (e.g. aws/creds/ ) instead of tokens. They use Sentinel as a language to access properties of the incoming requests.

Here is an example policy that fulfills the requirement of an incoming request to be performed during the business hours 7:00am to 6:00pm on work days:

{{/if}}

More information about {{uppercase @policyType}} policies can be found here.