Policy expressions: attributes, globs, read and write

The shape

tovio policy set <glob> --read <expr> [--write <expr>]

Globs

Standard path patterns: secrets/**, *.key, config/prod/*. A path can be matched by more than one policy; the most specific one wins, and tovio policy show <path> resolves what actually applies.

Predicates

The only leaf of the language is name=value — one =, compared as exact, case-sensitive bytes:

role=backendteam=paymentsclearance=secrets

A predicate is true when the identity presents a valid, unexpired, authority-signed claim with that name and value. Holding several claims for one name is fine — team=payments is true if any held team claim matches.

There are no ranges, no ordering, no substrings. clearance=secrets is an exact match, not a level comparison — clearance=topsecret does not satisfy it.

Operators

So a=1 & b=2 | c=3 parses as (a=1 & b=2) | c=3. Parentheses override and nest freely. The keyword forms are case-sensitive and exactly equivalent to the symbols.

ANY

ANY declares a clear path. It is a whole-expression keyword — role=x | ANY is a syntax error, not a shortcut.

Reserved attribute names

entity (human or agent), role, team, and clearance carry defined meaning. Every other name is an opaque attribute your authority defines. entity=human is how you keep a path off-limits to agents.

Where attributes come from

tovio access grant --identity ./peer.identity.pub --attr role=backend --attr team=payments

--identity takes a path to the recipient's identity.pub file, not a pasted key string, and --attr is repeatable.

Read versus write

--read governs decryption: it decides who the authority will wrap a content key for. --write governs who may modify the path, enforced before a commit is sealed and again at the relay as an attribute-based-signature check. The two are independent — a path may be world-readable and write-gated.

One asymmetry worth knowing: ! in a read_policy is discouraged, because read access is enforced by key availability and the authority reasons open-world about a claim you did not present. Prefer positive grants for reads. write_policy may use ! freely, since signature verification is closed-world over the proof's declared attributes.

Test rather than reason

tovio policy test <path> --identity ./peer.identity.pubtovio access check <path> --identity ./peer.identity.pub --write

Both evaluate the real expression. Checking beats reading the expression and believing you understood it.

Full grammar

The normative grammar lives in the policy specification on the documentation site — deliberately not reproduced in full here, so it cannot drift. This article covers what you need to write and read an everyday policy; the spec is the authority for the edge cases.