> For the complete documentation index, see [llms.txt](https://docs.enclaive.cloud/vault/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.enclaive.cloud/vault/tutorials/ui/access-control/policies.md).

# Policies

Policies provide a declarative way to grant or forbid access to certain paths and operations in Vault. In this step, you will create a policy and then edit it to support new requirements.

{% hint style="info" %}
This step assumes you started the Vault server and signed in with the root token in the Web UI step.
{% endhint %}

### Create a policy <a href="#create-a-policy" id="create-a-policy"></a>

1. Select **Policies** from the menu

<figure><img src="/files/EJOToDbjzrpTQFUxFUFE" alt=""><figcaption></figcaption></figure>

This view is the policy index and displays all the policies. The default policy and the root policy were created when Vault was initialized.

2. Select the **Create ACL policy** action.

<figure><img src="/files/O8ntRKlKfkEyzaO8SULe" alt=""><figcaption></figcaption></figure>

3. Enter `webapp` in the **Name** field.
4. Enter this policy in the **Policy** field.

   ```hcl
   # Read the configuration secret example
   path "secret/config" {
       capabilities = ["read"]
   }

   # List secrets engines
   path "sys/mounts" {
       capabilities = ["read"]
   }
   ```
5. Choose the **Create policy** action at the bottom of the view.

<figure><img src="/files/SYVSRI4cuqFKkb0Z7WNg" alt=""><figcaption></figcaption></figure>

The policy is created and this view displays its name and contents.

6. Select the **ACL Policies** navigation from within the view.

<figure><img src="/files/KbCsfJUPkUVR9Z2nh0pZ" alt=""><figcaption></figcaption></figure>

The view returns to the policy index. The new webapp policy is displayed.

{% hint style="info" %}
***Filtering***

When there are a lot of policies, the *Filter policies* field can narrow the displayed policies down to a manageable list or the exact policy.
{% endhint %}

### Edit a policy <a href="#edit-a-policy" id="edit-a-policy"></a>

The **webapp** policy needs to be updated to support a new secrets engine and its paths required and capabilities.

1. Select the **webapp** policy title from within the policy index view.

   This view displays the policy with its definition. The read-only policy field displays the entire contents of the policy.
2. Select the **Edit policy** action from within the view.

<figure><img src="/files/jA0AVxhbnt2yPpxrgFm5" alt=""><figcaption></figcaption></figure>

This view is the policy edit view. The **Policy** field provides a text editor preloaded with the policy definition.

3. Select the **Policy** text editor from within the view.

The editor enables navigation through the arrow keys.

4. Add this policy to after the other content in the **Policy** field.

```hcl
# Enable Transit secrets engine
path "sys/mounts/transit" {
    capabilities = ["create", "update"]
}

# Manage Transit secrets engine keys
path "transit/keys" {
    capabilities = ["list"]
}
path "transit/keys/*" {
    capabilities = ["create", "list", "read", "update"]
}
path "transit/keys/+/config" {
    capabilities = ["create", "update"]
}

# Encrypt with any Transit secrets engine key
path "transit/encrypt/*" {
    capabilities = ["create", "update"]
}

# Decrypt with any Transit secrets engine key
path "transit/decrypt/*" {
    capabilities = ["create", "update"]
}
```

{% hint style="info" %}
***Editing***

The editor supports common keyboard shortcuts for undo and redo. You can also reset every change back its original by choosing **Cancel**.
{% endhint %}

The updated policy needs to be saved.

5. Choose the **Save** action at the bottom of the view.

<figure><img src="/files/NRHZNfNVgk2i3WwOKVfL" alt=""><figcaption></figcaption></figure>

The policy is updated. The view returns to the policy and its updated definition.