uip gov

Manage UiPath governance — AOps policies, Access policies, and compliance packs — using the `uip gov` tool.

uip gov is the Governance tool: it manages three distinct governance surfaces under one CLI — AOps policies (product configuration limits enforced by UiPath products like StudioX), Access policies (who/what can invoke an Agent, Flow, or other agentic resource), and compliance packs (bundles of AOps/Access policies mapped to a named compliance framework, like ISO 42001, that can be toggled on for a tenant in one step). Install it with uip tools install gov, or invoke uip gov … and let auto-install run. See Tools (plugins) for the install model.

The tool ships as the @uipath/gov-tool package, and its command surface is split across this page and two sibling pages because of its size.

This resource spans four pages

• This page — concepts, and access-policy (list/get/create/update/delete/evaluate).
• aops-policy — policy CRUD, product, license-type, template.
• aops-policy deployment and deployed-policy — assign policies to tenants/users/groups, and resolve the effective policy at runtime.
• compliance-packs — catalog (browse) and state (per-tenant enable/disable/coverage).

概念

• AOps policies vs. Access policies — these are two independent systems with their own APIs, data shapes, and verbs; they are not variants of the same resource. AOps policies constrain product configuration (e.g. a StudioX policy limiting which project settings are allowed) and are scoped by productName/licenseType/tenant-user-group inheritance. Access policies constrain who/what can invoke a resource (e.g. which actors may invoke a given Agent) and are evaluated by a Policy Decision Point (PDP) against a live request context.
• Compliance packs bridge the two — a pack bundles a set of pre-built AOps policies (and potentially Access policies) mapped to clauses of a named framework (ISO 42001, etc.). Enabling a pack deploys its policies to Aops in one call instead of authoring each one by hand.
• Read-only reference data — product, license-type, and the compliance-pack catalog are read-only: they exist to discover valid values for the mutating commands (--product-name, license-type identifiers, packId), not to be edited via the CLI.

大纲

uip gov access-policy list [--limit <n>] [--offset <n>] [--filter <odata>] [--sort-by <field> asc|desc]
uip gov access-policy get <policyId>
uip gov access-policy create --file <path>
uip gov access-policy update --file <path>
uip gov access-policy delete <policyId...>
uip gov access-policy evaluate --resource-type <type> [--resource-id <id>] [--actor-identity-id <id>] [--actor-process-type <type>] [--actor-process-id <id>] [--folder-key <key>] [--trace-parent-id <id>]

uip gov access-policy

Manage Access Policies end-to-end. Two backing services are wrapped: the Policy Administration Point (PAP) for list/get/create/update/delete on policy records, and the Policy Decision Point (PDP) for evaluate, which resolves the effective Allow/Deny decision for a concrete request context.

备注：

Typical flow: author a PolicyDefinition JSON → create --file ... → evaluate --resource-type <type> (with other context flags) to confirm the policy takes effect → iterate with update --file ....

uip gov access-policy list

Search for policies with optional OData filtering and pagination.

选项

长	值	默认	描述
--limit <n>	non-negative integer	20	Page size — maximum policies to return.
--offset <n>	non-negative integer	0	Records to skip before the returned page.
--filter <filter>	OData expression	—	e.g. "status in ('Active')".
--sort-by <order>	<Field> asc|desc	—	e.g. "Name asc", "CreatedOn desc".
--login-validity <minutes>	non-negative integer	—	Override the interactive-login token lifetime for this call.

示例

uip gov access-policy list --filter "status in ('Active')" --sort-by "Name asc"

数据形状（--输出 json）

{
  "Code": "PolicyList",
  "Data": {
    "totalCount": 1,
    "results": [
      { "id": "a1b2c3d4-0000-0000-0000-000000000001", "name": "Agent Governance", "status": "Active" }
    ]
  }
}

uip gov access-policy get

Fetch the full PolicyDefinition for one policy by UUID — use to inspect selectors/rules/enforcement, or to seed an update.

参数

名称	必填	用途
<policyId>	是	Policy UUID, from access-policy list.

示例

uip gov access-policy get a1b2c3d4-0000-0000-0000-000000000001

数据形状（--输出 json）

{
  "Code": "PolicyGet",
  "Data": { "id": "a1b2c3d4-0000-0000-0000-000000000001", "name": "Agent Governance", "status": "Active" }
}

uip gov access-policy create

Create a new access policy from a JSON file conforming to PolicyDefinition. Sent as-is (no envelope wrapping) — do not include a server-assigned id.

选项

长	值	必填	描述
--file <path>	路径	是	JSON file containing the PolicyDefinition to create.
--login-validity <minutes>	non-negative integer	否	Override the interactive-login token lifetime.

A name conflict with an existing policy fails the call — check access-policy list first.

示例

uip gov access-policy create --file ./policy.json

数据形状（--输出 json）

{
  "Code": "PolicyCreated",
  "Data": {
    "statusCode": 200,
    "errors": null,
    "upsertedPolicy": { "id": "a1b2c3d4-0000-0000-0000-000000000001", "name": "Agent Governance", "status": "Active" }
  }
}

Capture upsertedPolicy.id for follow-up evaluate/update/delete calls.

uip gov access-policy update

Update an existing access policy from a JSON file. Sent as an HTTP PATCH — the file must include the policy's id.

选项

长	值	必填	描述
--file <path>	路径	是	JSON file with the updated PolicyDefinition (must include id).
--login-validity <minutes>	non-negative integer	否	Override the interactive-login token lifetime.

To seed the file: access-policy get <id>, edit the JSON, pass it back via --file.

示例

uip gov access-policy update --file ./policy.json

数据形状（--输出 json）

Same shape as create, with Code: "PolicyUpdated".

uip gov access-policy delete

Delete one or more access policies by UUID in a single request. Permanent — no soft-delete/undo.

参数

名称	必填	用途
<policyId...>	是	One or more policy UUIDs, space-separated.

示例

uip gov access-policy delete a1b2c3d4-0000-0000-0000-000000000001 a1b2c3d4-0000-0000-0000-000000000002

数据形状（--输出 json）

{ "Code": "PolicyDeleted", "Data": { "PolicyIds": ["a1b2c3d4-0000-0000-0000-000000000001", "a1b2c3d4-0000-0000-0000-000000000002"] } }

uip gov access-policy evaluate

Ask the PDP to resolve the effective Allow/Deny decision for a request context — preview what an actor will see before rollout, or debug a production denial. Requires tenant context (login must target a specific tenant, not just an organization).

选项

长	值	必填	描述
--resource-type <type>	one of Agent, AgenticProcess, RPAWorkflow, APIWorkflow, CaseManagement, Flow	是	The protected asset being accessed.
--resource-id <id>	字符串	否	Identifier of the specific resource instance (e.g. an Agent UUID).
--actor-identity-id <id>	字符串	否	Actor identifier — only required with an S2S token; with a user token the actor is inferred from the bearer.
--actor-process-type <type>	one of Agent, AgenticProcess, CaseManagement, Flow	否	The workflow/agent being executed on the actor's behalf, if any.
--actor-process-id <id>	字符串	否	Identifier of that executable (e.g. a Flow UUID).
--folder-key <key>	UUID	否	Folder key scoping the request.
--trace-parent-id <id>	字符串	否	W3C traceparent value to correlate this evaluation with upstream traces.
--login-validity <minutes>	non-negative integer	否	Override the interactive-login token lifetime.

Fails with a clear "tenant context" error if the client can't resolve a tenant ID from the current login.

示例

uip gov access-policy evaluate --resource-type Agent

数据形状（--输出 json）

{
  "Code": "PolicyEvaluated",
  "Data": { "enforcement": "Allow", "evaluationDetails": null, "effectivePolicies": [] }
}

相关内容

• aops-policy — policy CRUD, product, license-type, template.
• aops-policy deployment and deployed-policy — assign and resolve AOps policies.
• compliance-packs — catalog and per-tenant pack state.

另请参阅

• 工具（插件）
• 全局选项
• 退出代码