# uip gov

> Manage UiPath governance — AOps policies, Access policies, and compliance packs — using the `uip gov` tool.

`uip gov` is the Governance tool: it manages three distinct governance surfaces under one CLI — **AOps policies** (product configuration limits enforced by UiPath products like StudioX), **Access policies** (who/what can invoke an Agent, Flow, or other agentic resource), and **compliance packs** (bundles of AOps/Access policies mapped to a named compliance framework, like ISO 42001, that can be toggled on for a tenant in one step). Install it with `uip tools install gov`, or invoke `uip gov …` and let auto-install run. See [Tools (plugins)](./concepts-tools.md) for the install model.

The tool ships as the `@uipath/gov-tool` package, and its command surface is split across this page and two sibling pages because of its size.

## This resource spans four pages

- **This page** — concepts, and `access-policy` (list/get/create/update/delete/evaluate).
- [`aops-policy`](./uip-gov-aops-policy.md) — policy CRUD, `product`, `license-type`, `template`.
- [`aops-policy deployment` and `deployed-policy`](./uip-gov-aops-policy-deployment.md) — assign policies to tenants/users/groups, and resolve the effective policy at runtime.
- [`compliance-packs`](./uip-gov-compliance-packs.md) — `catalog` (browse) and `state` (per-tenant enable/disable/coverage).

## Concepts

- **AOps policies vs. Access policies** — these are two independent systems with their own APIs, data shapes, and verbs; they are not variants of the same resource. AOps policies constrain *product configuration* (e.g. a StudioX policy limiting which project settings are allowed) and are scoped by `productName`/`licenseType`/tenant-user-group inheritance. Access policies constrain *who/what can invoke a resource* (e.g. which actors may invoke a given Agent) and are evaluated by a Policy Decision Point (PDP) against a live request context.
- **Compliance packs bridge the two** — a pack bundles a set of pre-built AOps policies (and potentially Access policies) mapped to clauses of a named framework (ISO 42001, etc.). Enabling a pack deploys its policies to Aops in one call instead of authoring each one by hand.
- **Read-only reference data** — `product`, `license-type`, and the compliance-pack `catalog` are read-only: they exist to discover valid values for the mutating commands (`--product-name`, license-type identifiers, `packId`), not to be edited via the CLI.

## Synopsis

```text
uip gov access-policy list [--limit <n>] [--offset <n>] [--filter <odata>] [--sort-by <field> asc|desc]
uip gov access-policy get <policyId>
uip gov access-policy create --file <path>
uip gov access-policy update --file <path>
uip gov access-policy delete <policyId...>
uip gov access-policy evaluate --resource-type <type> [--resource-id <id>] [--actor-identity-id <id>] [--actor-process-type <type>] [--actor-process-id <id>] [--folder-key <key>] [--trace-parent-id <id>]
```

## uip gov access-policy

Manage Access Policies end-to-end. Two backing services are wrapped: the Policy Administration Point (PAP) for `list`/`get`/`create`/`update`/`delete` on policy records, and the Policy Decision Point (PDP) for `evaluate`, which resolves the effective Allow/Deny decision for a concrete request context.

:::note
Typical flow: author a `PolicyDefinition` JSON → `create --file ...` → `evaluate --resource-type <type>` (with other context flags) to confirm the policy takes effect → iterate with `update --file ...`.
:::

### uip gov access-policy list

Search for policies with optional OData filtering and pagination.

#### Options

| Long | Value | Default | Description |
|---|---|---|---|
| `--limit <n>` | non-negative integer | `20` | Page size — maximum policies to return. |
| `--offset <n>` | non-negative integer | `0` | Records to skip before the returned page. |
| `--filter <filter>` | OData expression | — | e.g. `"status in ('Active')"`. |
| `--sort-by <order>` | `<Field> asc\|desc` | — | e.g. `"Name asc"`, `"CreatedOn desc"`. |
| `--login-validity <minutes>` | non-negative integer | — | Override the interactive-login token lifetime for this call. |

#### Example

```bash
uip gov access-policy list --filter "status in ('Active')" --sort-by "Name asc"
```

#### Data shape (--output json)

```json
{
  "Code": "PolicyList",
  "Data": {
    "totalCount": 1,
    "results": [
      { "id": "a1b2c3d4-0000-0000-0000-000000000001", "name": "Agent Governance", "status": "Active" }
    ]
  }
}
```

### uip gov access-policy get

Fetch the full `PolicyDefinition` for one policy by UUID — use to inspect selectors/rules/enforcement, or to seed an `update`.

#### Arguments

| Name | Required | Purpose |
|---|---|---|
| `<policyId>` | yes | Policy UUID, from `access-policy list`. |

#### Example

```bash
uip gov access-policy get a1b2c3d4-0000-0000-0000-000000000001
```

#### Data shape (--output json)

```json
{
  "Code": "PolicyGet",
  "Data": { "id": "a1b2c3d4-0000-0000-0000-000000000001", "name": "Agent Governance", "status": "Active" }
}
```

### uip gov access-policy create

Create a new access policy from a JSON file conforming to `PolicyDefinition`. Sent as-is (no envelope wrapping) — do not include a server-assigned `id`.

#### Options

| Long | Value | Required | Description |
|---|---|---|---|
| `--file <path>` | path | **yes** | JSON file containing the `PolicyDefinition` to create. |
| `--login-validity <minutes>` | non-negative integer | no | Override the interactive-login token lifetime. |

A name conflict with an existing policy fails the call — check `access-policy list` first.

#### Example

```bash
uip gov access-policy create --file ./policy.json
```

#### Data shape (--output json)

```json
{
  "Code": "PolicyCreated",
  "Data": {
    "statusCode": 200,
    "errors": null,
    "upsertedPolicy": { "id": "a1b2c3d4-0000-0000-0000-000000000001", "name": "Agent Governance", "status": "Active" }
  }
}
```

Capture `upsertedPolicy.id` for follow-up `evaluate`/`update`/`delete` calls.

### uip gov access-policy update

Update an existing access policy from a JSON file. Sent as an HTTP PATCH — the file must include the policy's `id`.

#### Options

| Long | Value | Required | Description |
|---|---|---|---|
| `--file <path>` | path | **yes** | JSON file with the updated `PolicyDefinition` (must include `id`). |
| `--login-validity <minutes>` | non-negative integer | no | Override the interactive-login token lifetime. |

To seed the file: `access-policy get <id>`, edit the JSON, pass it back via `--file`.

#### Example

```bash
uip gov access-policy update --file ./policy.json
```

#### Data shape (--output json)

Same shape as `create`, with `Code: "PolicyUpdated"`.

### uip gov access-policy delete

Delete one or more access policies by UUID in a single request. Permanent — no soft-delete/undo.

#### Arguments

| Name | Required | Purpose |
|---|---|---|
| `<policyId...>` | yes | One or more policy UUIDs, space-separated. |

#### Example

```bash
uip gov access-policy delete a1b2c3d4-0000-0000-0000-000000000001 a1b2c3d4-0000-0000-0000-000000000002
```

#### Data shape (--output json)

```json
{ "Code": "PolicyDeleted", "Data": { "PolicyIds": ["a1b2c3d4-0000-0000-0000-000000000001", "a1b2c3d4-0000-0000-0000-000000000002"] } }
```

### uip gov access-policy evaluate

Ask the PDP to resolve the effective Allow/Deny decision for a request context — preview what an actor will see before rollout, or debug a production denial. Requires tenant context (login must target a specific tenant, not just an organization).

#### Options

| Long | Value | Required | Description |
|---|---|---|---|
| `--resource-type <type>` | one of `Agent`, `AgenticProcess`, `RPAWorkflow`, `APIWorkflow`, `CaseManagement`, `Flow` | **yes** | The protected asset being accessed. |
| `--resource-id <id>` | string | no | Identifier of the specific resource instance (e.g. an Agent UUID). |
| `--actor-identity-id <id>` | string | no | Actor identifier — only required with an S2S token; with a user token the actor is inferred from the bearer. |
| `--actor-process-type <type>` | one of `Agent`, `AgenticProcess`, `CaseManagement`, `Flow` | no | The workflow/agent being executed on the actor's behalf, if any. |
| `--actor-process-id <id>` | string | no | Identifier of that executable (e.g. a Flow UUID). |
| `--folder-key <key>` | UUID | no | Folder key scoping the request. |
| `--trace-parent-id <id>` | string | no | W3C `traceparent` value to correlate this evaluation with upstream traces. |
| `--login-validity <minutes>` | non-negative integer | no | Override the interactive-login token lifetime. |

Fails with a clear "tenant context" error if the client can't resolve a tenant ID from the current login.

#### Example

```bash
uip gov access-policy evaluate --resource-type Agent
```

#### Data shape (--output json)

```json
{
  "Code": "PolicyEvaluated",
  "Data": { "enforcement": "Allow", "evaluationDetails": null, "effectivePolicies": [] }
}
```

## Related

- [`aops-policy`](./uip-gov-aops-policy.md) — policy CRUD, `product`, `license-type`, `template`.
- [`aops-policy deployment` and `deployed-policy`](./uip-gov-aops-policy-deployment.md) — assign and resolve AOps policies.
- [`compliance-packs`](./uip-gov-compliance-packs.md) — catalog and per-tenant pack state.

## See also

- [Tools (plugins)](./concepts-tools.md)
- [Global options](./global-options.md)
- [Exit codes](./exit-codes.md)