Test a policy before you rely on it

tovio policy test <path>tovio policy test <path> --identity ./peer.identity.pubtovio policy test <path> --write

Answers whether an identity satisfies the effective policy for a path. It runs offline against the real expression — no network, no Key Authority round trip. With no --identity it tests your identity; --identity takes a path to the other party's identity.pub file.

When to run it

• After writing a policy, before committing anything sensitive under it.
• Before granting someone access, to confirm the attributes you plan to give actually satisfy the condition.
• After revoking, to confirm they no longer do.
• When someone reports they cannot read something they should.

The related check

tovio access check <path> --identity ./peer.identity.pub

policy test asks whether the expression is satisfied. access check asks whether that recipient can actually read the path. They usually agree; when they do not, the gap is enrolment or key state rather than the expression — start with tovio access list and tovio key status.

The trap this catches

policy test passing does not mean the person can read content that is already committed. Grants take effect at the next commit of a matching path. If the expression is satisfied but reads still fail, that timing is usually why.

Do this before the commit

Testing after committing a secret is testing whether the horse is still in the stable.