> ## Documentation Index
> Fetch the complete documentation index at: https://mintlify.com/NVIDIA/OpenShell/llms.txt
> Use this file to discover all available pages before exploring further.

# openshell policy

> CLI reference for policy commands: set, get, list, and delete. Manage sandbox and gateway-global policies.

# openshell policy

Alias: `pol`

Manage sandbox policies. Network and inference policy sections are hot-reloadable on running sandboxes without a restart.

<Tip>
  Pass `--global` to any subcommand to operate on the gateway-wide global policy instead of a per-sandbox policy.
</Tip>

***

## openshell policy set

Apply or replace a policy on a running sandbox (or gateway-global).

```bash theme={null}
openshell policy set [NAME] --policy FILE [OPTIONS]
```

<ParamField body="NAME" type="string">
  Sandbox name. Defaults to the last-used sandbox. Ignored when `--global` is set.
</ParamField>

<ParamField body="--policy" type="string" required>
  Path to a policy YAML file.
</ParamField>

<ParamField body="--global" type="boolean">
  Apply as a gateway-global policy that overrides sandbox-level policies for all sandboxes. Prompts for confirmation unless `--yes` is also set.
</ParamField>

<ParamField body="--yes" type="boolean">
  Skip the confirmation prompt when setting a global policy.
</ParamField>

<ParamField body="--wait" type="boolean">
  Wait for the sandbox to confirm it has loaded the new policy. Not supported for global policies (global policies are effective immediately).
</ParamField>

<ParamField body="--timeout" type="integer" default="60">
  Timeout in seconds for `--wait`.
</ParamField>

### Examples

```bash theme={null}
# Apply a policy to a specific sandbox
openshell policy set my-sandbox --policy policy.yaml

# Apply and wait for the sandbox to load it
openshell policy set my-sandbox --policy policy.yaml --wait

# Apply a gateway-global policy with confirmation prompt
openshell policy set --global --policy strict.yaml

# Apply global policy non-interactively (e.g., in CI)
openshell policy set --global --policy strict.yaml --yes
```

<Note>
  `--wait` polls the sandbox until it reports the expected policy revision. Use this in scripts that apply a policy and then immediately run a command that depends on it.
</Note>

***

## openshell policy get

Show the active policy for a sandbox or the gateway-global policy.

```bash theme={null}
openshell policy get [NAME] [OPTIONS]
```

<ParamField body="NAME" type="string">
  Sandbox name. Defaults to the last-used sandbox. Ignored when `--global` is set.
</ParamField>

<ParamField body="--rev" type="integer" default="0">
  Specific policy revision to retrieve. Defaults to the latest revision.
</ParamField>

<ParamField body="--full" type="boolean">
  Print the full policy document as YAML instead of a summary.
</ParamField>

<ParamField body="--global" type="boolean">
  Show the gateway-global policy revision.
</ParamField>

### Examples

```bash theme={null}
# Show the active policy summary for a sandbox
openshell policy get my-sandbox

# Print the full YAML
openshell policy get my-sandbox --full

# Show a specific revision
openshell policy get my-sandbox --rev 3

# Show the gateway-global policy
openshell policy get --global
```

***

## openshell policy list

List policy revision history for a sandbox or the gateway-global policy.

```bash theme={null}
openshell policy list [NAME] [OPTIONS]
```

<ParamField body="NAME" type="string">
  Sandbox name. Defaults to the last-used sandbox. Ignored when `--global` is set.
</ParamField>

<ParamField body="--limit" type="integer" default="20">
  Maximum number of revisions to return.
</ParamField>

<ParamField body="--global" type="boolean">
  List gateway-global policy revisions.
</ParamField>

### Examples

```bash theme={null}
openshell policy list my-sandbox
openshell policy list --global
openshell policy list my-sandbox --limit 5
```

***

## openshell policy delete

Delete the gateway-global policy lock, restoring per-sandbox policy control. Only operates on global policy; per-sandbox policy delete is not supported.

```bash theme={null}
openshell policy delete --global [OPTIONS]
```

<ParamField body="--global" type="boolean" required>
  Required. Delete the global policy setting.
</ParamField>

<ParamField body="--yes" type="boolean">
  Skip the confirmation prompt.
</ParamField>

### Example

```bash theme={null}
openshell policy delete --global
openshell policy delete --global --yes
```

***

## Policy behavior

| Section            | Reloadable                          | Applied at                |
| ------------------ | ----------------------------------- | ------------------------- |
| `network_policies` | Yes — hot-reload on running sandbox | Creation and `policy set` |
| `inference`        | Yes — hot-reload on running sandbox | Creation and `policy set` |
| `filesystem`       | No — locked at creation             | Sandbox creation only     |
| `process`          | No — locked at creation             | Sandbox creation only     |

Global policy overrides per-sandbox policy. Deleting the global policy with `policy delete --global` restores each sandbox's own policy.

See [Policy Schema](/reference/policy-schema) for the full YAML format.