Every tovio policy subcommand

The complete verified surface, and which ones you will actually use.

Written By Dustin

Last updated About 3 hours ago

policy is a Team-tier command, so tovio help does not list it. Use tovio help --team, or tovio help policy for the full text.

The everyday four

Command	What it does
`policy set <glob> --read <expr> [--write <expr>]`	Set or replace the policy for a path glob. `--read` is required.
`policy list`	Every declaration in the manifest.
`policy show <path>`	The effective policy for one path, after glob resolution.
`policy test <path> [--identity <file>] [--write]`	Evaluate the expression offline for an identity.

Maintenance

Command	What it does
`policy remove <glob>`	Remove one declaration. The glob must match a `set` pattern exactly.
`policy sign`	Re-attest the manifest. The documented recovery when it is present but unattested. Safe to re-run.

Governance

Command	What it does
`policy protect <lane-glob>`	Lane protection: require an approved, reviewed proposal to land. Takes `--require-review`, `--min-approvals`, `--reviewers`, repeatable `--reviewer`, `--required-checks`, and `--remove`.
`policy change-control <path-glob>`	Path-scoped change control: require an approved proposal for changes touching a glob, on any lane. Takes `--min-approvals`, `--reviewers`, repeatable `--reviewer`, `--required-checks` and `--remove` — but not `--require-review`, which exists only on `policy protect`.
`policy proposal-visibility --mode <m>`	Who may create a restricted-visibility proposal: `disabled`, `owner-only`, `members` (default), or `allowlist` with repeatable `--allow <DID>`.
`policy web-auth`	Which browser mechanism may make a mutating Forge request. Repeatable `--allow bridge\|pure-web\|bearer`, plus `--require-bridge-for <glob>`. No flags at all resets to the default posture.

Repository-wide settings

Command	What it does
`policy signing`	Require signatures on commits and protected-ref updates. See Require signed commits and protected-ref updates.
`policy audit`	Require a justification for security-sensitive mutations. See Require a justification for sensitive operations.
`policy chunking`	The per-repository chunking policy for future snapshots: `--min`, `--average`, `--max`, `--threshold` in bytes, or `--reset`.
`policy hook add\|remove\|list`	Attach a sandboxed plugin to a lifecycle event as an enforcing gate.

Things that are not policy subcommands

There is no policy promote, no policy grant, and no policy revoke. Upgrading a repository is tovio identity init; recipients are managed under tovio access.

Policy hooks

tovio policy hook add <event> <plugin-id> [--required]

tovio policy hook remove <event> <plugin-id>

tovio policy hook list

Valid events are pre-snapshot, pre-land, resolve-requested and proposal-created. A hook is enforcing by default; --required additionally blocks on error and unavailability. Capability grants are deny-by-default, and read_protected_plaintext can never be granted from a flag.

The authority

This is an index to help you find the right subcommand. The CLI reference in the documentation is the system of record for exact flag semantics, and tovio help policy always reflects the version you actually have installed — check it against your build before scripting.