> For the complete documentation index, see [llms.txt](https://docs.codemash.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.codemash.io/cloud/membership/policies/new.md).

# Create a policy

**Where:** Membership → Policies → New · `/projects/<project>/membership/policies/new`

{% hint style="info" %}
Screenshot TODO — capture comes from testing-plan area **16-membership**.
{% endhint %}

A policy is a named set of permission statements — what its holders may do, per module and action. On this screen the whole policy is one **Policy document**: a JSON editor where the name, description, and permissions all live together. The editor validates against the Norbix policy schema in real time and highlights violations; **Save** stays disabled until the document is valid and has a `name`.

## The policy document

* `version` — the schema version; new documents use `2026-09-17`.
* `name`, `description` — the policy's metadata, taken from the document on save.
* `permissions` — a list of statements. Each has an optional `sid`, an `effect` (`Allow` or `Deny`), a list of `actions` (such as `database:Read`), and a list of `resources` in the form `<account>:<project>:<module>:<kind>:<name>` — wildcards (`*`) are allowed and clamped to your own account and project.

## Example

```json
{
  "version": "2026-09-17",
  "name": "database-read-only",
  "description": "Read access to every database collection in this project.",
  "permissions": [
    {
      "sid": "Statement1",
      "effect": "Allow",
      "actions": ["database:Read"],
      "resources": ["acc_*:pr_4kX9mQvR2tYw7ZbC1dFgHj:database:collection:*"]
    }
  ]
}
```

After **Save** the policy appears under **Custom Policies** and can be attached to [roles](/cloud/membership/roles.md). It gets a public id in the `pol_…` form.

## Use it from code

[Membership → Policies](/sdks-and-cli/membership/policies.md)

## API reference

Endpoints: [Membership → Policies](/api-reference/membership/policies.md).