> For the complete documentation index, see [llms.txt](https://docs.enclaive.cloud/nitride/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.enclaive.cloud/nitride/tutorials/attestation-blueprint-1/enable-namespacing.md).

# Enable Namespacing

Tokens can be issued for namespaces. To enable this feature, use the `-namespacing` flag. The `vhsm nitride init` command simplifies the setup of vHSM by automating authentication, identity creation, policy enforcement, and attestation. The namespacing feature allows fine-grained access control across [multiple namespaces](https://docs.enclaive.cloud/virtual-hsm/vhsm-cli/configuration-and-management/vhsm-namespace).

{% hint style="info" %}
**Note**:

* Namespaced tokens have inlined policies.
* The default policy can be overwritten with an HCL policy file.
  {% endhint %}

Enable token namespacing with a policy file:

```
vhsm nitride init -namespacing @policy.hcl
```

Alternatively, pipe the policy file:

```
cat policy.hcl | vhsm nitride init -namespacing
```

This ensures that child namespaces can have distinct access control policies.

### **Example Setup with Namespaces**

If the vHSM plugin is enabled in the `root` namespace, while workloads access resources in the `GCP` and `azure`namespaces.

**!. I**nitialize vHSM with token namespacing

```sh
vhsm nitride init -namespacing @policy.hcl
```

2. Enable authentication in the namespace root

```
vhsm auth enable -path=ratls ratls
```

3. [Create identities](/nitride/tutorials/attestation-blueprint-1/register-identities.md) in the `root` namespace

```sh
vhsm nitride identity create @platform.json
vhsm nitride identity create @firmware.json
vhsm nitride identity create @workload.json
```

4. [Define policies](/nitride/tutorials/attestation-blueprint-1/create-policy.md) in each namespace

```
vhsm nitride policy create @policy.json
```

5. [Create attestations ](/nitride/tutorials/attestation-blueprint-1/create-attestation.md)for each namespace.

{% hint style="info" %}
**Note:** You only have one instance of the plugin enabled in `root`, and namespaces are assigned through the attestation. When you run `nitride attestation create`, the JSON can contain a `namespace` field.  When this is set to `gcp`, the token is issued from `root` for `gcp`.
{% endhint %}

```
vhsm nitride attestation create @attestation.json
```

With this setup, tokens issued in `root` can reference and delegate access to workloads running in the `gcp` , and `azure`namespaces. Each namespace can have its own policies and attestations.