ACL Policies are written in Hashicorp Configuration Language ( HCL ) or JSON and describe which paths in Vault a user or machine is allowed to access. Here is an example policy:

Role Governing Policies (RGPs) are tied to client tokens or identities which is similar to ACL policies. They use Sentinel as a language framework to enable fine-grained policy decisions.

Here is an example policy that uses RGP to restrict access to the admin policy such that a user named "James Thomas" or has the Team Lead role can manage the admin policy:

Endpoint Governing Policies (EGPs) are tied to particular paths (e.g. aws/creds/ ) instead of tokens. They use Sentinel as a language to access properties of the incoming requests.

Here is an example policy that fulfills the requirement of an incoming request to be performed during the business hours 7:00am to 6:00pm on work days: