Write your first policy

tovio policy set 'secrets/**' --read 'role=backend'tovio policy set 'config/prod.env' --read 'role=ops' --write 'role=ops'

A policy attaches a path glob to a read condition, and optionally a write condition. --read is required; omitting --write means the read policy governs writes too.

The syntax people get wrong

Predicates use a single =. There is no == operator, and role == "backend" is a parse error, not a stricter form of the same thing. Combine predicates with &, | and !:

tovio policy set 'config/production/**' --read 'role=senior & clearance=secrets'

See it take effect

policy set prints which way it went:

✓ Policy set for secrets/**  Files under secrets/** will be encrypted on the next commit.

On the next commit is the load-bearing phrase. Setting a policy does not reach back and encrypt what is already in history. Commit a file under the glob, then read it back — tovio cat decrypts it for you because you hold the key; someone without it gets a TVO-PERM-001 denial naming exactly which attribute they are missing.

A policy whose read expression is ANY declares the path clear, and policy set says so instead.

Test before relying on it

tovio policy test <path>tovio policy test <path> --identity ./peer.identity.pubtovio policy test <path> --write

Evaluates offline against the real expression. Do this before you assume a policy covers what you meant.

Check what applies

tovio policy show <path>tovio policy list

Commit the manifest

The manifest is repository state. Commit and push it, or your replicas are still running the old rules. If a peer ever reports the manifest is unattested, the fix is tovio policy sign.

Removing one

tovio policy remove 'secrets/**'

The pattern must match a set pattern exactly. Removing a policy stops future content being encrypted under it. It does not decrypt what is already committed.

Order matters

Set the policy before committing the secret. A file committed in the clear stays in history in the clear — that then needs tovio obliterate, and the credential should be treated as exposed.