Create
Create a policy.
Request body
Bounded key/value metadata bag for IaC marking and customer tags. See .rfcs/object-annotations.md §2. Limits: ≤16 entries; keys 1–128 chars matching ^[A-Za-z][A-Za-z0-9._/-]{0,127}$; values 0–256 chars matching URL-safe ASCII; total serialized ≤4096 bytes. Keys starting with c1/ are reserved for server-managed use and rejected on write.
Well-known keys: managed_by, iac_workspace, iac_resource_address, iac_tool_version.
When set, the new policy's baseline defers to another policy of the same type when no rule matches, instead of an inline baseline step list. Mutually exclusive with the baseline entry in policy_steps. Requires the POLICY_REFERENCES_POLICY feature; obeys the same depth/cycle/self rules as Rule.policy_id.
The description of the new policy.
The display name of the new policy.
Step sequences for this policy. The map must include a baseline entry keyed by the lowercased policy type (e.g., "grant"). Additional entries with opaque keys can be added for conditional routing via the rules array.
The type of policy to create (grant, revoke, or certify).
This field is no longer used. Configure delegate reassignment in the policy step instead.
Response
The CreatePolicyResponse message contains the created policy object.