Every policy evaluation answers a single question in context.

Can [actor] perform [action] on [object] in [environment]?

Actors are any entity that can perform actions in the system. This includes human users, teams, agents, integrations, and the public.

# Example actor types
user:user_id
team:team_id
agent:agent_id
integration:github
integration:vercel
public

Actions describe operations that can be performed on Nebula objects. The full set includes read, write, approve, merge, export, deploy, and manage operations.

read_blob, read_path, read_secret
write_changeset, approve_changeset, merge_changeset
export_git, create_projection, deploy
manage_variables, read_variable_metadata, read_variable_value
inject_variable, reveal_variable
save_secret, push_secret, export_secret

Policy decisions determine the outcome for a given action. Decisions are evaluated in priority order, and the first match wins.

• →allow: Action permitted
• →redact: Include path but mask content
• →template: Replace with generated content
• →omit: Exclude from output silently
• →block: Fail the operation with policy error
• →embargo: Block until explicit release

Use the CLI to create local policies and test policy evaluation.

neb policy set "src/secrets/**" block
neb policy set "docs/**" allow
neb policy set ".env.example" redact
neb policy check "src/config.ts" read_blob
neb policy list

Projections must respect policy decisions. The projection layer evaluates policies for each path and produces a manifest classifying every path before export.