ts policy

Show or replace the launch policy — the document that decides which applications clients may run and how. Editing it is a read, edit, write cycle against a plain JSON file.

Usage

ts policy [print | set <file> | schema] [--version=N]

Description

ts policy with no action prints the active policy document exactly as the server stores it, so redirecting it to a file and writing it back is a faithful round trip.

ts policy set <file> replaces the policy. The server validates the document before storing it and signs it on write; a document that names a property the server does not model is rejected rather than stored, because a property nothing reads is a silent no-op. Pass - instead of a path to read from standard input.

ts policy schema prints the JSON schema, which is useful for editor completion and for validating a document before you send it.

Replacing the policy is recorded in the audit log, attributed to the account that ran the command.

Options

Flag	Description	Default/Values	Notes
--version	Schema version to fetch.	Default: current	Only meaningful with schema.

Examples

# Look at the current policy
ts policy

# The usual edit cycle
ts policy > policy.json
$EDITOR policy.json
ts policy set policy.json

# Pipe from another tool
jq '.apps += [{"id":"acme"}]' policy.json | ts policy set -

# Save the schema for your editor
ts policy schema > policy.schema.json

Output

print and schema emit JSON on standard output and nothing else, so they pipe cleanly. set reports success:

Policy updated from policy.json

A rejected document explains what was wrong:

Error: The server returned 400: Policy contains properties this server does not
model, so they would be stored but never applied or served to any client.

Exit Codes

0 on success. -1 when the server rejects the document. -5 when the account is not a Server Administrator. -6 when the file does not exist.

Related Commands

• ts audit — See who changed the policy and when.
• Launcher policy — What the policy document means.