Module 4docs/iam/policies

Policy Engineering: Managed vs. Inline

Name: SoldierX AI SIEM
Brand: SoldierX

A policy is a named, reusable set of permission statements. Each statement grants or denies one or more actions, optionally restricted to specific resources.

Managed Policies vs. Inline Policies

SoldierX AI SIEM supports two distinct policy lifecycles:

Dimension	Managed Policy	Inline Policy
Lifecycle Binding	Independent catalog artifact	1:1 binding with host entity
Reusability	Attachable to multiple users, groups, roles	Single entity attachment only
Detachment Behavior	Breaks link; policy remains safe in library	Permanently deletes policy from database
Recommended Use Case	Standardized team roles, baseline access	One-off temporary developer overrides

INLINE POLICY DETACHMENT IS PERMANENT DESTRUCTION

Detaching a managed policy merely unlinks it from the identity. Detaching an inline policy permanently purges its statement records from the database. The console presents an explicit confirmation warning before executing an inline detachment.

Statement Schema & Grammar

Every policy statement is composed of four strictly typed properties:

policy-statement-example.json

{
  "Effect": "Allow",
  "Action": "siem:case:update",
  "Resources": ["*"],
  "Scope": ["own"]
}

Field	What it holds
Effect	Allow or Deny. An explicit Deny always overrides an Allow from anywhere else.
Action	One action string, following the consistent `service:module:operation` pattern (e.g. `siem:loganalysis:read`).
Resources	The resource axis: which specific assets or cases this statement applies to, or every resource of that kind in the account.
Scope	The scope axis: the caller's own items only, or an explicit list of other users the grant applies to (where the action supports it).

Visual Form Builder vs. Structured Code Editor

The SoldierX AI SIEM policy management console provides a dual-mode editing experience:

Visual Form Builder

Presents searchable action pickers, scope dropdowns, and target entity pickers. Automatically highlights missing read dependencies before the administrator saves.

Structured Code Editor

A full text-based editor for building the same statements directly, with live validation, inline suggestions, and autocomplete for actions and resource IDs. Both modes stay in sync, so you can switch between them freely while editing the same policy.

Self-Lockout Prevention

When you save changes to a policy you're editing, the system checks whether the change would remove your own ability to manage policies going forward, and blocks the save with a warning if it would - so you can't accidentally lock yourself out.

The ceiling rule

An administrator can never grant someone else a permission, resource, or scope they don't themselves hold. Attempting to build a policy or role that exceeds your own access is rejected with an explanation of exactly what you're allowed to grant. The Account Owner is exempt from this rule, since they hold unrestricted access by definition.

When you're editing a policy that grants more than your own ceiling allows, any statement beyond what you're personally permitted to grant is shown locked: visible for transparency, but its effect/action/resource fields can't be changed and it can't be deleted, whether you're using the visual editor or the structured editor.

Keeping Grants Consistent

Two safeguards run whenever a policy is built or attached, independent of the self-lockout and ceiling checks above:

Dependency checking: Some permissions only make sense alongside another one - you can't meaningfully be granted "resolve a case" without also being able to view cases. The system flags a grant missing its prerequisite read action, without necessarily blocking it.
The two-axis restriction stays independent: The resource restriction (which assets or cases) and the scope restriction (own items, or a named list of other users) are tracked and enforced separately, so a single statement can combine both, such as "manage case assignment, but only for these specific cases, and only assigning to these specific teammates."