Skip to content
deedglassdocs

Policy packs

Install a tested set of policies as files, checked against a signed index and shown to you before anything is written.

Before you start

  • The deedglass CLI. Installing a pack only writes files; pushing the policy to your server needs an org admin key.

1. List the packs

Section titled “1. List the packs”
Terminal window
deedglass policy packs list
deedglass policy packs verify
  • postgres-safe (free): the Postgres connector.
  • supabase-mcp (free): Supabase’s MCP server, wrapped as the connector supabase.
  • stripe-refunds (free): the Stripe connector (sandbox).
  • github-agent (free): the GitHub connector.
  • money-movement (Pro): Stripe refunds, payouts and transfers, with amount caps and two admins for large ones.

verify checks every file of every pack against its sha256 in the index and runs each pack’s own test cases. Each pack carries at least 12.

2. Install one

Section titled “2. Install one”
Terminal window
deedglass policy install postgres-safe

In order, install:

  1. Reads the packs. By default it uses the copy built into deedglass, so it works offline. --from <dir|.tar.gz> reads a local copy of the policy-packs repo, and --latest downloads the newest release over HTTPS. That is the only time it uses the network.
  2. Checks the index. A copy from outside the binary must be sealed by a pack key this build knows, and then every file must match its sha256. If one doesn’t: ✕ This pack doesn't match its signed index (postgres-safe.yaml). Nothing was written.
  3. Checks the tier. A Pro pack asks for a Pro licence; without one it prints Pro packs need a Pro licence: deedglass.com/pro. Nothing was written. Free packs never open the licence file.
  4. Compiles the policy and runs its cases. A failure writes nothing.
  5. Shows the plan: each file, new or changed, with a diff for changes. Then it asks Write 2 files? [y/N]. Pass --yes to skip the question.
  6. Writes policies/<pack>.yaml and policies/<pack>.cases.yaml (--dir changes the folder) and prints the next step.

Pin a version with postgres-safe@1.0.0. Running install again on unchanged files writes nothing.

3. Push it in shadow first

Section titled “3. Push it in shadow first”
Terminal window
deedglass policy test policies/postgres-safe.yaml
deedglass policy push policies/postgres-safe.yaml
deedglass policy activate postgres-safe --version 1 --mode shadow --reason "trying the pack"

Compare it with what you run today using deedglass policy replay, then activate it with --mode enforce.

Pro packs and your licence

Section titled “Pro packs and your licence”

A Pro licence is checked only when you install a Pro pack. A policy you installed keeps enforcing if the licence ends, because rules never read the licence.

What it doesn’t do

Section titled “What it doesn’t do”
  • A pack is a starting point, not a review of your setup. Read its cases before you enforce it.
  • It never pushes or activates a policy. You do that, in shadow first.
  • Until the pack signing key is published, only the copy built into deedglass installs; --from and --latest refuse an index they can’t check.