> ## Documentation Index
> Fetch the complete documentation index at: https://docs.controlplane.com/llms.txt
> Use this file to discover all available pages before exploring further.

# policy

> cpln policy — Manage access policies to resource that control permissions for users, groups, and service accounts.

Manage access policies

For a detailed overview, please visit the [policy's](/reference/policy) reference page.

```none theme={null}
cpln policy [SUBCOMMAND]
```

```text theme={null}
Commands:
  cpln policy access-report <ref>   Show the access report for the referenced policy
  cpln policy add-binding <ref>     Bind one or more permissions to the referenced policy and associate it with one or more users / service accounts / groups / identities
  cpln policy audit [ref]           Retrieve audit trail events for the referenced policy
  cpln policy clone <ref>           Clone a policy  [aliases: copy]
  cpln policy create                Create a new policy
  cpln policy delete <ref...>       Delete one or more referenced policies
  cpln policy edit <ref>            Edit the referenced policy, as YAML, within an editor
  cpln policy eventlog <ref>        Show the event log of the referenced policy  [aliases: log]
  cpln policy get [ref...]          Retrieve one or more referenced policies
  cpln policy patch <ref>           Update the referenced policy's metadata using an input file
  cpln policy permissions           Show the grantable permissions for a policy object type
  cpln policy query                 Find all the policies based on the given query
  cpln policy remove-binding <ref>  Remove the bindings of one or more permissions from the referenced policy and disassociate it from one or more users / service accounts / groups / identities
  cpln policy tag <ref...>          Manage the tags belonging to one or more referenced policies
  cpln policy update <ref>          Update properties of the referenced policy

Options:
  --help  Show help  [boolean]
```

***

#### policy access-report

Show the access report for the referenced policy

**Usage**

```none theme={null}
cpln policy access-report <ref> [OPTIONS]
```

<Accordion title="Reference">
  ```text theme={null}
  Positionals:
    ref  The resource reference. Usually it is the name of the resource.  [required]

  Context options:
    --profile  Override the profile. The default profile can be set using the `cpln profile set-default` command or by setting the CPLN_PROFILE environment variable
    --org      Override the organization. The default organization can be set in your profile by using the `cpln profile update` command

  Format options:
    --output, -o  Set the output format  [choices: "text", "json", "yaml", "json-slim", "yaml-slim", "tf", "crd", "names"]
    --color       Colorize the output  [boolean] [default: true]
    --ts          Timestamp format if the output format is text (e.g., --output=text)  [choices: "iso", "local", "age"]
    --max         Maximum number of records to show. A value less than 1 will return all records.  [number] [default: 50]

  Request options:
    --token         Override the authorization token
    --endpoint      Override the API URL
    --insecure, -k  Ignore TLS errors  [boolean]

  Debug options:
    --verbose, -v  Enable verbose output to stderr  [boolean] [default: false]
    --debug, -d    Show all HTTP communications  [boolean] [default: false]

  Options:
    --help  Show help  [boolean]
  ```

  [Common Options Reference](/cli-reference/using-cli/common-options)
</Accordion>

<Accordion title="Example">
  <CodeGroup>
    ```bash Command theme={null}
    cpln policy access-report demo-policy --org demo-cpln-organization
    ```

    ```text Output theme={null}
    +-----------+--------------------------------------------------------+--------+
    |PERMISSION |PRINCIPAL                                               |GRANTED |
    |-----------|--------------------------------------------------------|--------|
    |create     |/org/demo-cpln-organization/group/superusers            |manage  |
    |create     |/org/demo-cpln-organization/serviceaccount/controlplane |manage  |
    |delete     |/org/demo-cpln-organization/group/superusers            |manage  |
    |delete     |/org/demo-cpln-organization/serviceaccount/controlplane |manage  |
    |edit       |/org/demo-cpln-organization/group/superusers            |manage  |
    |edit       |/org/demo-cpln-organization/serviceaccount/controlplane |manage  |
    |manage     |/org/demo-cpln-organization/group/superusers            |manage  |
    |manage     |/org/demo-cpln-organization/serviceaccount/controlplane |manage  |
    |view       |/org/demo-cpln-organization/group/viewers               |view    |
    |view       |/org/demo-cpln-organization/group/superusers            |manage  |
    |view       |/org/demo-cpln-organization/serviceaccount/controlplane |manage  |
    +-----------+--------------------------------------------------------+--------+
    ```
  </CodeGroup>
</Accordion>

***

#### policy add-binding

Bind one or more permissions to the referenced policy and associate it with one or more users / service accounts / groups / identities

**Usage**

```none theme={null}
cpln policy add-binding <ref> --permission PERMISSION_NAME COMMAND_OPTIONS [OPTIONS]
```

<Accordion title="Reference">
  ```text theme={null}
  Positionals:
    ref  The resource reference. Usually it is the name of the resource.  [required]

  Command options:
    --email           User email to add permission
    --serviceaccount  Service account name to add permission
    --group           Group name to add permission
    --identity        Identity name OR link to add permission
    --permission      Permission to add  [required]

  Context options:
    --profile  Override the profile. The default profile can be set using the `cpln profile set-default` command or by setting the CPLN_PROFILE environment variable
    --org      Override the organization. The default organization can be set in your profile by using the `cpln profile update` command
    --gvc      Override the global virtual cloud. The default global virtual cloud can be set in your profile by using the `cpln profile update` command

  Format options:
    --output, -o  Set the output format  [choices: "text", "json", "yaml", "json-slim", "yaml-slim", "tf", "crd", "names"]
    --color       Colorize the output  [boolean] [default: true]
    --ts          Timestamp format if the output format is text (e.g., --output=text)  [choices: "iso", "local", "age"]
    --max         Maximum number of records to show. A value less than 1 will return all records.  [number] [default: 50]

  Request options:
    --token         Override the authorization token
    --endpoint      Override the API URL
    --insecure, -k  Ignore TLS errors  [boolean]

  Debug options:
    --verbose, -v  Enable verbose output to stderr  [boolean] [default: false]
    --debug, -d    Show all HTTP communications  [boolean] [default: false]

  Options:
    --help  Show help  [boolean]
  ```

  [Common Options Reference](/cli-reference/using-cli/common-options)
</Accordion>

<Accordion title="Example">
  * Bind the view permission to the referenced policy named \`demo-policy-add-binding\` and associate it with the built-in controlplane service account

  <CodeGroup>
    ```bash Command theme={null}
    cpln policy add-binding demo-policy --permission view --serviceaccount controlplane --org demo-cpln-organization
    ```

    ```text Output theme={null}
    +------------+------------+--------------+------------+--------+--------+--------------+
    |NAME        |DESCRIPTION |CREATED       |TARGET KIND |MATCHES |ORIGIN  |TAGS          |
    |------------|------------|--------------|------------|--------|--------|--------------|
    |demo-policy |demo-policy |7 minutes ago |org         |all     |default |drink="water" |
    +------------+------------+--------------+------------+--------+--------+--------------+
    ```
  </CodeGroup>
</Accordion>

***

#### policy audit

Retrieve audit trail events for the referenced policy

**Usage**

```none theme={null}
cpln policy audit [ref] [OPTIONS]
```

<Accordion title="Reference">
  ```text theme={null}
  Positionals:
    ref  The resource reference. Usually it is the name of the resource.

  Command options:
    --subject  Filter by subject (serviceaccount name or user email)  [string]
    --context  Audit context name (the 'cpln' context displays Control Plane actions)  [string] [default: "cpln"]
    --since    Relative lookback window from now (e.g., 1h, 24h, 7d). Mutually exclusive with --from/--to  [string] [default: "7d"]
    --from     Start time for audit events (ISO 8601 format or relative duration, e.g., 2025-10-23T07:00:00Z, 7d, 1h). Cannot be used with --since  [string]
    --to       End time for audit events (ISO 8601 format or relative duration, e.g., 2025-10-23T07:00:00Z, 1d, 30m)  [string]

  Context options:
    --profile  Override the profile. The default profile can be set using the `cpln profile set-default` command or by setting the CPLN_PROFILE environment variable
    --org      Override the organization. The default organization can be set in your profile by using the `cpln profile update` command

  Format options:
    --output, -o  Set the output format  [choices: "text", "json", "yaml", "json-slim", "yaml-slim", "tf", "crd", "names"]
    --color       Colorize the output  [boolean] [default: true]
    --ts          Timestamp format if the output format is text (e.g., --output=text)  [choices: "iso", "local", "age"]
    --max         Maximum number of records to show. A value less than 1 will return all records.  [number] [default: 50]

  Request options:
    --token         Override the authorization token
    --endpoint      Override the API URL
    --insecure, -k  Ignore TLS errors  [boolean]

  Debug options:
    --verbose, -v  Enable verbose output to stderr  [boolean] [default: false]
    --debug, -d    Show all HTTP communications  [boolean] [default: false]

  Options:
    --help  Show help  [boolean]
  ```

  [Common Options Reference](/cli-reference/using-cli/common-options)
</Accordion>

***

#### policy clone

Clone a policy

**Usage**

```none theme={null}
cpln policy clone <ref> --name CLONE_NAME [OPTIONS]
```

<Accordion title="Reference">
  ```text theme={null}
  Positionals:
    ref  The resource reference. Usually it is the name of the resource.  [required]

  Command options:
    --name         Set the name for the clone  [required]
    --description  Optional description, defaults to the name if not set
    --tag          Attach tags (e.g., --tag drink=water)

  Context options:
    --profile  Override the profile. The default profile can be set using the `cpln profile set-default` command or by setting the CPLN_PROFILE environment variable
    --org      Override the organization. The default organization can be set in your profile by using the `cpln profile update` command

  Format options:
    --output, -o  Set the output format  [choices: "text", "json", "yaml", "json-slim", "yaml-slim", "tf", "crd", "names"]
    --color       Colorize the output  [boolean] [default: true]
    --ts          Timestamp format if the output format is text (e.g., --output=text)  [choices: "iso", "local", "age"]
    --max         Maximum number of records to show. A value less than 1 will return all records.  [number] [default: 50]

  Request options:
    --token         Override the authorization token
    --endpoint      Override the API URL
    --insecure, -k  Ignore TLS errors  [boolean]

  Debug options:
    --verbose, -v  Enable verbose output to stderr  [boolean] [default: false]
    --debug, -d    Show all HTTP communications  [boolean] [default: false]

  Options:
    --help  Show help  [boolean]
  ```

  [Common Options Reference](/cli-reference/using-cli/common-options)
</Accordion>

<Accordion title="Example">
  <CodeGroup>
    ```bash Command theme={null}
    cpln policy clone demo-policy --name demo-policy-clone --org demo-cpln-organization
    ```

    ```text Output theme={null}
    +------------------+---------------------+--------+------------+--------+--------+--------------+
    |NAME              |DESCRIPTION          |CREATED |TARGET KIND |MATCHES |ORIGIN  |TAGS          |
    |------------------|---------------------|--------|------------|--------|--------|--------------|
    |demo-policy-clone |Clone of demo-policy |Now     |org         |all     |default |drink="water" |
    +------------------+---------------------+--------+------------+--------+--------+--------------+
    ```
  </CodeGroup>
</Accordion>

***

#### policy create

Create a new policy

**Usage**

```none theme={null}
cpln policy create --name POLICY_NAME --target-kind TARGET [OPTIONS]
```

<Accordion title="Reference">
  ```text theme={null}
  Command options:
    --name                 Name of the new policy, type - to generate a valid name  [required]
    --description, --desc  Optional description, defaults to the name if not set
    --target-kind          Select a target kind for this policy  [required] [choices: "account", "agent", "auditctx", "cloudaccount", "domain", "dbcluster", "group", "gvc", "identity", "image", "location", "memcachecluster", "org", "policy", "quota", "secret", "serviceaccount", "spicedbcluster", "task", "user", "volumeset", "workload"]
    --all                  Apply policy to all instances of the kind  [boolean]
    --resource             Enumerate resource names to add to the policy
    --tag                  Attach tags (e.g., --tag drink=water)

  Query spec options:
    --query-match     Query filter type  [choices: "all", "none", "any"] [default: "all"]
    --query-property  Property to query
    --query-tag       Tag to query
    --query-rel       Relation to query

  Context options:
    --profile  Override the profile. The default profile can be set using the `cpln profile set-default` command or by setting the CPLN_PROFILE environment variable
    --org      Override the organization. The default organization can be set in your profile by using the `cpln profile update` command

  Format options:
    --output, -o  Set the output format  [choices: "text", "json", "yaml", "json-slim", "yaml-slim", "tf", "crd", "names"]
    --color       Colorize the output  [boolean] [default: true]
    --ts          Timestamp format if the output format is text (e.g., --output=text)  [choices: "iso", "local", "age"]
    --max         Maximum number of records to show. A value less than 1 will return all records.  [number] [default: 50]

  Request options:
    --token         Override the authorization token
    --endpoint      Override the API URL
    --insecure, -k  Ignore TLS errors  [boolean]

  Debug options:
    --verbose, -v  Enable verbose output to stderr  [boolean] [default: false]
    --debug, -d    Show all HTTP communications  [boolean] [default: false]

  Options:
    --help  Show help  [boolean]
  ```

  [Common Options Reference](/cli-reference/using-cli/common-options)
</Accordion>

<Accordion title="Example">
  <CodeGroup>
    ```bash Command theme={null}
    cpln policy create --name demo-policy --target-kind org --all --desc demo-policy --tag drink=water --org demo-cpln-organization
    ```

    ```text Output theme={null}
    +------------+------------+--------+------------+--------+--------+--------------+
    |NAME        |DESCRIPTION |CREATED |TARGET KIND |MATCHES |ORIGIN  |TAGS          |
    |------------|------------|--------|------------|--------|--------|--------------|
    |demo-policy |demo-policy |Now     |org         |all     |default |drink="water" |
    +------------+------------+--------+------------+--------+--------+--------------+
    ```
  </CodeGroup>
</Accordion>

***

#### policy delete

Delete one or more referenced policies

**Usage**

```none theme={null}
cpln policy delete <ref...> [OPTIONS]
```

<Warning>
  Deleting a policy will remove all associated resources (targets, bindings, etc.)
</Warning>

<Accordion title="Reference">
  ```text theme={null}
  Positionals:
    ref  One or more resource references. Usually it is the name of the resource.  [array] [required] [default: []]

  Context options:
    --profile  Override the profile. The default profile can be set using the `cpln profile set-default` command or by setting the CPLN_PROFILE environment variable
    --org      Override the organization. The default organization can be set in your profile by using the `cpln profile update` command

  Format options:
    --output, -o  Set the output format  [choices: "text", "json", "yaml", "json-slim", "yaml-slim", "tf", "crd", "names"]
    --color       Colorize the output  [boolean] [default: true]
    --ts          Timestamp format if the output format is text (e.g., --output=text)  [choices: "iso", "local", "age"]
    --max         Maximum number of records to show. A value less than 1 will return all records.  [number] [default: 50]

  Request options:
    --token         Override the authorization token
    --endpoint      Override the API URL
    --insecure, -k  Ignore TLS errors  [boolean]

  Debug options:
    --verbose, -v  Enable verbose output to stderr  [boolean] [default: false]
    --debug, -d    Show all HTTP communications  [boolean] [default: false]

  Options:
    --help  Show help  [boolean]
  ```

  [Common Options Reference](/cli-reference/using-cli/common-options)
</Accordion>

<Accordion title="Example">
  <CodeGroup>
    ```bash Command theme={null}
    cpln policy delete demo-policy --org demo-cpln-organization
    ```

    ```text Output theme={null}
    If the delete was successful, a new command prompt will be shown.
    ```
  </CodeGroup>
</Accordion>

***

#### policy edit

Edit the referenced policy, as YAML, within an editor

**Usage**

```none theme={null}
cpln policy edit <ref> [OPTIONS]
```

<Note>
  The default editor can be set by using the EDITOR environment variable.
</Note>

<Accordion title="Reference">
  ```text theme={null}
  Positionals:
    ref  The resource reference. Usually it is the name of the resource.  [required]

  Command options:
    --replace, -r  Replace instead of patch/merge  [boolean] [default: false]

  Context options:
    --profile  Override the profile. The default profile can be set using the `cpln profile set-default` command or by setting the CPLN_PROFILE environment variable
    --org      Override the organization. The default organization can be set in your profile by using the `cpln profile update` command

  Format options:
    --output, -o  Set the output format  [choices: "text", "json", "yaml", "json-slim", "yaml-slim", "tf", "crd", "names"]
    --color       Colorize the output  [boolean] [default: true]
    --ts          Timestamp format if the output format is text (e.g., --output=text)  [choices: "iso", "local", "age"]
    --max         Maximum number of records to show. A value less than 1 will return all records.  [number] [default: 50]

  Request options:
    --token         Override the authorization token
    --endpoint      Override the API URL
    --insecure, -k  Ignore TLS errors  [boolean]

  Debug options:
    --verbose, -v  Enable verbose output to stderr  [boolean] [default: false]
    --debug, -d    Show all HTTP communications  [boolean] [default: false]

  Options:
    --help  Show help  [boolean]
  ```

  [Common Options Reference](/cli-reference/using-cli/common-options)
</Accordion>

<Accordion title="Example">
  <CodeGroup>
    ```bash Command theme={null}
    cpln policy edit demo-policy --org demo-cpln-organization
    ```

    ```text Output theme={null}
    Your default editor will be launched.

    Once any modifications are saved, the updates will be sent to the API.
    ```
  </CodeGroup>
</Accordion>

***

#### policy eventlog

Show the event log of the referenced policy

**Usage**

```none theme={null}
cpln policy eventlog <ref> [OPTIONS]
```

<Accordion title="Reference">
  ```text theme={null}
  Positionals:
    ref  The resource reference. Usually it is the name of the resource.  [required]

  Context options:
    --profile  Override the profile. The default profile can be set using the `cpln profile set-default` command or by setting the CPLN_PROFILE environment variable
    --org      Override the organization. The default organization can be set in your profile by using the `cpln profile update` command

  Format options:
    --output, -o  Set the output format  [choices: "text", "json", "yaml", "json-slim", "yaml-slim", "tf", "crd", "names"]
    --color       Colorize the output  [boolean] [default: true]
    --ts          Timestamp format if the output format is text (e.g., --output=text)  [choices: "iso", "local", "age"]
    --max         Maximum number of records to show. A value less than 1 will return all records.  [number] [default: 50]

  Request options:
    --token         Override the authorization token
    --endpoint      Override the API URL
    --insecure, -k  Ignore TLS errors  [boolean]

  Debug options:
    --verbose, -v  Enable verbose output to stderr  [boolean] [default: false]
    --debug, -d    Show all HTTP communications  [boolean] [default: false]

  Options:
    --help  Show help  [boolean]
  ```

  [Common Options Reference](/cli-reference/using-cli/common-options)
</Accordion>

<Accordion title="Example">
  <CodeGroup>
    ```bash Command theme={null}
    cpln policy eventlog demo-policy --org demo-cpln-organization
    ```

    ```text Output theme={null}
    The event log for the referenced policy will be shown.
    ```
  </CodeGroup>
</Accordion>

***

#### policy get

Retrieve one or more referenced policies

**Usage**

```none theme={null}
cpln policy get [ref...] [OPTIONS]
```

<Note>
  An empty reference will return all references
</Note>

<Accordion title="Reference">
  ```text theme={null}
  Positionals:
    ref  One or more resource references. Usually it is the name of the resource.  [array] [default: []]

  Context options:
    --profile  Override the profile. The default profile can be set using the `cpln profile set-default` command or by setting the CPLN_PROFILE environment variable
    --org      Override the organization. The default organization can be set in your profile by using the `cpln profile update` command

  Format options:
    --output, -o  Set the output format  [choices: "text", "json", "yaml", "json-slim", "yaml-slim", "tf", "crd", "names"]
    --color       Colorize the output  [boolean] [default: true]
    --ts          Timestamp format if the output format is text (e.g., --output=text)  [choices: "iso", "local", "age"]
    --max         Maximum number of records to show. A value less than 1 will return all records.  [number] [default: 50]

  Request options:
    --token         Override the authorization token
    --endpoint      Override the API URL
    --insecure, -k  Ignore TLS errors  [boolean]

  Debug options:
    --verbose, -v  Enable verbose output to stderr  [boolean] [default: false]
    --debug, -d    Show all HTTP communications  [boolean] [default: false]

  Options:
    --help  Show help  [boolean]
  ```

  [Common Options Reference](/cli-reference/using-cli/common-options)
</Accordion>

<Accordion title="Example">
  * Get all policies

  <CodeGroup>
    ```bash Command theme={null}
    cpln policy get --org demo-cpln-organization
    ```

    ```text Output theme={null}
    +---------------------------+-----------------------------------------+--------------+----------------+--------+--------+--------------+
    |NAME                       |DESCRIPTION                              |CREATED       |TARGET KIND     |MATCHES |ORIGIN  |TAGS          |
    |---------------------------|-----------------------------------------|--------------|----------------|--------|--------|--------------|
    |demo-policy                |demo-policy                              |7 minutes ago |org             |all     |default |drink="water" |
    |demo-policy-get-1          |demo-policy-get-1                        |Now           |org             |all     |default |              |
    |demo-policy-get-2          |demo-policy-get-2                        |Now           |org             |all     |default |              |
    |superusers-agent           |Built-in policy granting full access ... |5 years ago   |agent           |all     |builtin |              |
    |superusers-auditctx        |Built-in policy granting full access ... |5 years ago   |auditctx        |all     |builtin |              |
    |superusers-cloudaccount    |Built-in policy granting full access ... |5 years ago   |cloudaccount    |all     |builtin |              |
    |superusers-domain          |Built-in policy granting full access ... |5 years ago   |domain          |all     |builtin |              |
    |superusers-group           |Built-in policy granting full access ... |5 years ago   |group           |all     |builtin |              |
    |superusers-gvc             |Built-in policy granting full access ... |5 years ago   |gvc             |all     |builtin |              |
    |superusers-identity        |Built-in policy granting full access ... |5 years ago   |identity        |all     |builtin |              |
    |superusers-image           |Built-in policy granting full access ... |5 years ago   |image           |all     |builtin |              |
    |superusers-ipset           |Built-in policy granting full access ... |1 year ago    |ipset           |all     |builtin |              |
    |superusers-location        |Built-in policy granting full access ... |5 years ago   |location        |all     |builtin |              |
    |superusers-memcachecluster |Built-in policy granting full access ... |3 years ago   |memcachecluster |all     |builtin |              |
    |superusers-mk8s            |Built-in policy granting full access ... |3 years ago   |mk8s            |all     |builtin |              |
    |superusers-org             |Built-in policy granting full access ... |5 years ago   |org             |all     |builtin |              |
    |superusers-policy          |Built-in policy granting full access ... |5 years ago   |policy          |all     |builtin |              |
    |superusers-quota           |Built-in policy granting full access ... |5 years ago   |quota           |all     |builtin |              |
    |superusers-secret          |Built-in policy granting full access ... |5 years ago   |secret          |all     |builtin |              |
    |superusers-serviceaccount  |Built-in policy granting full access ... |5 years ago   |serviceaccount  |all     |builtin |              |
    |superusers-spicedbcluster  |Built-in policy granting full access ... |2 years ago   |spicedbcluster  |all     |builtin |              |
    |superusers-task            |Built-in policy granting full access ... |5 years ago   |task            |all     |builtin |              |
    |superusers-user            |Built-in policy granting full access ... |5 years ago   |user            |all     |builtin |              |
    |superusers-volumeset       |Built-in policy granting full access ... |3 years ago   |volumeset       |all     |builtin |              |
    |superusers-workload        |Built-in policy granting full access ... |5 years ago   |workload        |all     |builtin |              |
    |viewers-agent              |Built-in policy granting read-only ac... |5 years ago   |agent           |all     |builtin |              |
    |viewers-auditctx           |Built-in policy granting read-only ac... |5 years ago   |auditctx        |all     |builtin |              |
    |viewers-cloudaccount       |Built-in policy granting read-only ac... |5 years ago   |cloudaccount    |all     |builtin |              |
    |viewers-domain             |Built-in policy granting read-only ac... |5 years ago   |domain          |all     |builtin |              |
    |viewers-group              |Built-in policy granting read-only ac... |5 years ago   |group           |all     |builtin |              |
    |viewers-gvc                |Built-in policy granting read-only ac... |5 years ago   |gvc             |all     |builtin |              |
    |viewers-identity           |Built-in policy granting read-only ac... |5 years ago   |identity        |all     |builtin |              |
    |viewers-image              |Built-in policy granting read-only ac... |5 years ago   |image           |all     |builtin |              |
    |viewers-ipset              |Built-in policy granting read-only ac... |1 year ago    |ipset           |all     |builtin |              |
    |viewers-location           |Built-in policy granting read-only ac... |5 years ago   |location        |all     |builtin |              |
    |viewers-memcachecluster    |Built-in policy granting read-only ac... |3 years ago   |memcachecluster |all     |builtin |              |
    |viewers-mk8s               |Built-in policy granting read-only ac... |3 years ago   |mk8s            |all     |builtin |              |
    |viewers-policy             |Built-in policy granting read-only ac... |5 years ago   |policy          |all     |builtin |              |
    |viewers-quota              |Built-in policy granting read-only ac... |5 years ago   |quota           |all     |builtin |              |
    |viewers-secret             |Built-in policy granting read-only ac... |5 years ago   |secret          |all     |builtin |              |
    |viewers-serviceaccount     |Built-in policy granting read-only ac... |5 years ago   |serviceaccount  |all     |builtin |              |
    |viewers-spicedbcluster     |Built-in policy granting read-only ac... |2 years ago   |spicedbcluster  |all     |builtin |              |
    |viewers-task               |Built-in policy granting read-only ac... |5 years ago   |task            |all     |builtin |              |
    |viewers-user               |Built-in policy granting read-only ac... |5 years ago   |user            |all     |builtin |              |
    |viewers-volumeset          |Built-in policy granting read-only ac... |3 years ago   |volumeset       |all     |builtin |              |
    |viewers-workload           |Built-in policy granting read-only ac... |5 years ago   |workload        |all     |builtin |              |
    +---------------------------+-----------------------------------------+--------------+----------------+--------+--------+--------------+
    ```
  </CodeGroup>

  * Get one policy

  <CodeGroup>
    ```bash Command theme={null}
    cpln policy get demo-policy-get-1 --org demo-cpln-organization
    ```

    ```text Output theme={null}
    +------------------+------------------+--------+------------+--------+--------+-----+
    |NAME              |DESCRIPTION       |CREATED |TARGET KIND |MATCHES |ORIGIN  |TAGS |
    |------------------|------------------|--------|------------|--------|--------|-----|
    |demo-policy-get-1 |demo-policy-get-1 |Now     |org         |all     |default |     |
    +------------------+------------------+--------+------------+--------+--------+-----+
    ```
  </CodeGroup>

  * Get multiple policies

  <CodeGroup>
    ```bash Command theme={null}
    cpln policy get demo-policy-get-1 demo-policy-get-2 --org demo-cpln-organization
    ```

    ```text Output theme={null}
    +------------------+------------------+--------+------------+--------+--------+-----+
    |NAME              |DESCRIPTION       |CREATED |TARGET KIND |MATCHES |ORIGIN  |TAGS |
    |------------------|------------------|--------|------------|--------|--------|-----|
    |demo-policy-get-1 |demo-policy-get-1 |Now     |org         |all     |default |     |
    |demo-policy-get-2 |demo-policy-get-2 |Now     |org         |all     |default |     |
    +------------------+------------------+--------+------------+--------+--------+-----+
    ```
  </CodeGroup>
</Accordion>

***

#### policy patch

Update the referenced policy's metadata using an input file

**Usage**

```none theme={null}
cpln policy patch <ref> --file FILE_NAME [OPTIONS]
```

<Note>
  Running this command with the option **`--file -`** sets the input to stdin. The input is required to be a valid JSON or YAML string (e.g., `{"description": "My new description"}` or `description: My new description`). To complete the update, press Control-D (or Control-Z if you are using Windows).
</Note>

<Accordion title="Reference">
  ```text theme={null}
  Positionals:
    ref  The resource reference. Usually it is the name of the resource.  [required]

  Command options:
    --file, -f  File to load the patch from. Use `--file -` to enable input from stdin.  [required]

  Context options:
    --profile  Override the profile. The default profile can be set using the `cpln profile set-default` command or by setting the CPLN_PROFILE environment variable
    --org      Override the organization. The default organization can be set in your profile by using the `cpln profile update` command

  Format options:
    --output, -o  Set the output format  [choices: "text", "json", "yaml", "json-slim", "yaml-slim", "tf", "crd", "names"]
    --color       Colorize the output  [boolean] [default: true]
    --ts          Timestamp format if the output format is text (e.g., --output=text)  [choices: "iso", "local", "age"]
    --max         Maximum number of records to show. A value less than 1 will return all records.  [number] [default: 50]

  Request options:
    --token         Override the authorization token
    --endpoint      Override the API URL
    --insecure, -k  Ignore TLS errors  [boolean]

  Debug options:
    --verbose, -v  Enable verbose output to stderr  [boolean] [default: false]
    --debug, -d    Show all HTTP communications  [boolean] [default: false]

  Options:
    --help  Show help  [boolean]
  ```

  [Common Options Reference](/cli-reference/using-cli/common-options)
</Accordion>

<Accordion title="Example">
  <CodeGroup>
    ```bash Command theme={null}
    cpln policy patch demo-policy --file update.json --org demo-cpln-organization
    ```

    ```text Output theme={null}
    The changes within the JSON file will be performed against the referenced policy.
    ```
  </CodeGroup>
</Accordion>

***

#### policy permissions

Show the grantable permissions for a policy object type

**Usage**

```none theme={null}
cpln policy permissions [OPTIONS]
```

<Accordion title="Reference">
  ```text theme={null}
  Context options:
    --profile  Override the profile. The default profile can be set using the `cpln profile set-default` command or by setting the CPLN_PROFILE environment variable
    --org      Override the organization. The default organization can be set in your profile by using the `cpln profile update` command

  Format options:
    --output, -o  Set the output format  [choices: "text", "json", "yaml", "json-slim", "yaml-slim", "tf", "crd", "names"]
    --color       Colorize the output  [boolean] [default: true]
    --ts          Timestamp format if the output format is text (e.g., --output=text)  [choices: "iso", "local", "age"]
    --max         Maximum number of records to show. A value less than 1 will return all records.  [number] [default: 50]

  Request options:
    --token         Override the authorization token
    --endpoint      Override the API URL
    --insecure, -k  Ignore TLS errors  [boolean]

  Debug options:
    --verbose, -v  Enable verbose output to stderr  [boolean] [default: false]
    --debug, -d    Show all HTTP communications  [boolean] [default: false]

  Options:
    --help  Show help  [boolean]
  ```

  [Common Options Reference](/cli-reference/using-cli/common-options)
</Accordion>

<Accordion title="Example">
  <CodeGroup>
    ```bash Command theme={null}
    cpln policy permissions --org demo-cpln-organization
    ```

    ```text Output theme={null}
    +-------+-------------------------+-----------------------------------+
    |NAME   |DESCRIPTION              |IMPLIES                            |
    |-------|-------------------------|-----------------------------------|
    |create |Create new policies      |                                   |
    |delete |Delete existing policies |                                   |
    |edit   |Modify existing policies |view                               |
    |manage |Full access              |create, delete, edit, manage, view |
    |view   |Read-only view           |                                   |
    +-------+-------------------------+-----------------------------------+
    ```
  </CodeGroup>
</Accordion>

***

#### policy query

Find all the policies based on the given query

**Usage**

```none theme={null}
cpln policy query QUERY_OPTIONS [OPTIONS]
```

<Accordion title="Reference">
  ```text theme={null}
  Query options:
    --match             Query filter type  [choices: "all", "none", "any"] [default: "all"]
    --property, --prop  Property to query
    --tag               Tag to query
    --rel               Relation to query

  Context options:
    --profile  Override the profile. The default profile can be set using the `cpln profile set-default` command or by setting the CPLN_PROFILE environment variable
    --org      Override the organization. The default organization can be set in your profile by using the `cpln profile update` command

  Format options:
    --output, -o  Set the output format  [choices: "text", "json", "yaml", "json-slim", "yaml-slim", "tf", "crd", "names"]
    --color       Colorize the output  [boolean] [default: true]
    --ts          Timestamp format if the output format is text (e.g., --output=text)  [choices: "iso", "local", "age"]
    --max         Maximum number of records to show. A value less than 1 will return all records.  [number] [default: 50]

  Request options:
    --token         Override the authorization token
    --endpoint      Override the API URL
    --insecure, -k  Ignore TLS errors  [boolean]

  Debug options:
    --verbose, -v  Enable verbose output to stderr  [boolean] [default: false]
    --debug, -d    Show all HTTP communications  [boolean] [default: false]

  Options:
    --help  Show help  [boolean]
  ```

  [Common Options Reference](/cli-reference/using-cli/common-options)
</Accordion>

<Accordion title="Example">
  <Note>
    Use the `--match` option to display **all**, **none**, or **any** of the results based on a given property or tag
  </Note>

  * Search for a policy based on the name property

  <CodeGroup>
    ```bash Command theme={null}
    cpln policy query --match any --prop name=demo-policy --org demo-cpln-organization
    ```

    ```text Output theme={null}
    +------------+------------+--------------+------------+--------+--------+--------------+
    |NAME        |DESCRIPTION |CREATED       |TARGET KIND |MATCHES |ORIGIN  |TAGS          |
    |------------|------------|--------------|------------|--------|--------|--------------|
    |demo-policy |demo-policy |7 minutes ago |org         |all     |default |drink="water" |
    +------------+------------+--------------+------------+--------+--------+--------------+
    ```
  </CodeGroup>

  * Search for a policy based on the description property

  <CodeGroup>
    ```bash Command theme={null}
    cpln policy query --match any --prop description="demo-policy" --org demo-cpln-organization
    ```

    ```text Output theme={null}
    +------------+------------+--------------+------------+--------+--------+--------------+
    |NAME        |DESCRIPTION |CREATED       |TARGET KIND |MATCHES |ORIGIN  |TAGS          |
    |------------|------------|--------------|------------|--------|--------|--------------|
    |demo-policy |demo-policy |7 minutes ago |org         |all     |default |drink="water" |
    +------------+------------+--------------+------------+--------+--------+--------------+
    ```
  </CodeGroup>

  * Search for a policy based on a tag

  <CodeGroup>
    ```bash Command theme={null}
    cpln policy query --match any --tag drink=water --org demo-cpln-organization
    ```

    ```text Output theme={null}
    +------------+------------+--------------+------------+--------+--------+--------------+
    |NAME        |DESCRIPTION |CREATED       |TARGET KIND |MATCHES |ORIGIN  |TAGS          |
    |------------|------------|--------------|------------|--------|--------|--------------|
    |demo-policy |demo-policy |7 minutes ago |org         |all     |default |drink="water" |
    +------------+------------+--------------+------------+--------+--------+--------------+
    ```
  </CodeGroup>

  * Search for a policy based on a property and tag

  <CodeGroup>
    ```bash Command theme={null}
    cpln policy query --match any --prop description="demo-policy" --tag drink=water --org demo-cpln-organization
    ```

    ```text Output theme={null}
    +------------+------------+--------------+------------+--------+--------+--------------+
    |NAME        |DESCRIPTION |CREATED       |TARGET KIND |MATCHES |ORIGIN  |TAGS          |
    |------------|------------|--------------|------------|--------|--------|--------------|
    |demo-policy |demo-policy |7 minutes ago |org         |all     |default |drink="water" |
    +------------+------------+--------------+------------+--------+--------+--------------+
    ```
  </CodeGroup>
</Accordion>

***

#### policy remove-binding

Remove the bindings of one or more permissions from the referenced policy and disassociate it from one or more users / service accounts / groups / identities

**Usage**

```none theme={null}
cpln policy remove-binding <ref> --permission PERMISSION_NAME COMMAND_OPTIONS [OPTIONS]
```

<Accordion title="Reference">
  ```text theme={null}
  Positionals:
    ref  The resource reference. Usually it is the name of the resource.  [required]

  Command options:
    --email           User email to remove permission
    --serviceaccount  Service account name to remove permission
    --group           Group name to remove permission
    --identity        Identity name OR link to remove permission
    --permission      Permission to remove  [required]

  Context options:
    --profile  Override the profile. The default profile can be set using the `cpln profile set-default` command or by setting the CPLN_PROFILE environment variable
    --org      Override the organization. The default organization can be set in your profile by using the `cpln profile update` command
    --gvc      Override the global virtual cloud. The default global virtual cloud can be set in your profile by using the `cpln profile update` command

  Format options:
    --output, -o  Set the output format  [choices: "text", "json", "yaml", "json-slim", "yaml-slim", "tf", "crd", "names"]
    --color       Colorize the output  [boolean] [default: true]
    --ts          Timestamp format if the output format is text (e.g., --output=text)  [choices: "iso", "local", "age"]
    --max         Maximum number of records to show. A value less than 1 will return all records.  [number] [default: 50]

  Request options:
    --token         Override the authorization token
    --endpoint      Override the API URL
    --insecure, -k  Ignore TLS errors  [boolean]

  Debug options:
    --verbose, -v  Enable verbose output to stderr  [boolean] [default: false]
    --debug, -d    Show all HTTP communications  [boolean] [default: false]

  Options:
    --help  Show help  [boolean]
  ```

  [Common Options Reference](/cli-reference/using-cli/common-options)
</Accordion>

<Accordion title="Example">
  * Remove the binding of the view permission from the policy named `demo-policy` and disassociate it with the built-in controlplane service account.

  <CodeGroup>
    ```bash Command theme={null}
    cpln policy remove-binding demo-policy --permission manage --serviceaccount controlplane --org demo-cpln-organization
    ```

    ```text Output theme={null}
    +------------+------------+--------------+------------+--------+--------+--------------+
    |NAME        |DESCRIPTION |CREATED       |TARGET KIND |MATCHES |ORIGIN  |TAGS          |
    |------------|------------|--------------|------------|--------|--------|--------------|
    |demo-policy |demo-policy |7 minutes ago |org         |all     |default |drink="water" |
    +------------+------------+--------------+------------+--------+--------+--------------+
    ```
  </CodeGroup>
</Accordion>

***

#### policy tag

Manage the tags belonging to one or more referenced policies

**Usage**

```none theme={null}
cpln policy tag <ref...> --tag KEY=VALUE [OPTIONS]
```

<Note>
  Built-in tags, which begin with cpln/\*, can't be modified.
</Note>

<Accordion title="Reference">
  ```text theme={null}
  Positionals:
    ref  One or more resource references. Usually it is the name of the resource.  [array] [required] [default: []]

  Command options:
    --tag         Attach tags (e.g., --tag drink=water)
    --remove-tag  Remove tags (e.g., --remove-tag tagname)

  Context options:
    --profile  Override the profile. The default profile can be set using the `cpln profile set-default` command or by setting the CPLN_PROFILE environment variable
    --org      Override the organization. The default organization can be set in your profile by using the `cpln profile update` command

  Format options:
    --output, -o  Set the output format  [choices: "text", "json", "yaml", "json-slim", "yaml-slim", "tf", "crd", "names"]
    --color       Colorize the output  [boolean] [default: true]
    --ts          Timestamp format if the output format is text (e.g., --output=text)  [choices: "iso", "local", "age"]
    --max         Maximum number of records to show. A value less than 1 will return all records.  [number] [default: 50]

  Request options:
    --token         Override the authorization token
    --endpoint      Override the API URL
    --insecure, -k  Ignore TLS errors  [boolean]

  Debug options:
    --verbose, -v  Enable verbose output to stderr  [boolean] [default: false]
    --debug, -d    Show all HTTP communications  [boolean] [default: false]

  Options:
    --help  Show help  [boolean]
  ```

  [Common Options Reference](/cli-reference/using-cli/common-options)
</Accordion>

<Accordion title="Example">
  * Add a tag to a policy

  <CodeGroup>
    ```bash Command theme={null}
    cpln policy tag demo-policy-tag-1 --tag drink=water --org demo-cpln-organization
    ```

    ```text Output theme={null}
    +------------------+------------------+--------+------------+--------+--------+--------------+
    |NAME              |DESCRIPTION       |CREATED |TARGET KIND |MATCHES |ORIGIN  |TAGS          |
    |------------------|------------------|--------|------------|--------|--------|--------------|
    |demo-policy-tag-1 |demo-policy-tag-1 |Now     |org         |all     |default |drink="water" |
    +------------------+------------------+--------+------------+--------+--------+--------------+
    ```
  </CodeGroup>

  * Update same tag (after running the example above)

  <CodeGroup>
    ```bash Command theme={null}
    cpln policy tag demo-policy-tag-1 --tag drink=coffee --org demo-cpln-organization
    ```

    ```text Output theme={null}
    +------------------+------------------+--------+------------+--------+--------+---------------+
    |NAME              |DESCRIPTION       |CREATED |TARGET KIND |MATCHES |ORIGIN  |TAGS           |
    |------------------|------------------|--------|------------|--------|--------|---------------|
    |demo-policy-tag-1 |demo-policy-tag-1 |Now     |org         |all     |default |drink="coffee" |
    +------------------+------------------+--------+------------+--------+--------+---------------+
    ```
  </CodeGroup>

  * Remove tag (after running the example above)

  <CodeGroup>
    ```bash Command theme={null}
    cpln policy tag demo-policy-tag-1 --remove drink --org demo-cpln-organization
    ```

    ```text Output theme={null}
    +------------------+------------------+--------+------------+--------+--------+-----+
    |NAME              |DESCRIPTION       |CREATED |TARGET KIND |MATCHES |ORIGIN  |TAGS |
    |------------------|------------------|--------|------------|--------|--------|-----|
    |demo-policy-tag-1 |demo-policy-tag-1 |Now     |org         |all     |default |     |
    +------------------+------------------+--------+------------+--------+--------+-----+
    ```
  </CodeGroup>

  * Add same tag to multiple policies

  <CodeGroup>
    ```bash Command theme={null}
    cpln policy tag demo-policy-tag-1 demo-policy-tag-2 --tag multiple-policies=true --org demo-cpln-organization
    ```

    ```text Output theme={null}
    +------------------+------------------+--------+------------+--------+--------+-------------------------+
    |NAME              |DESCRIPTION       |CREATED |TARGET KIND |MATCHES |ORIGIN  |TAGS                     |
    |------------------|------------------|--------|------------|--------|--------|-------------------------|
    |demo-policy-tag-1 |demo-policy-tag-1 |Now     |org         |all     |default |multiple-policies="true" |
    |demo-policy-tag-2 |demo-policy-tag-2 |Now     |org         |all     |default |multiple-policies="true" |
    +------------------+------------------+--------+------------+--------+--------+-------------------------+
    ```
  </CodeGroup>

  * Update same tag on multiple policies (after running the example above)

  <CodeGroup>
    ```bash Command theme={null}
    cpln policy tag demo-policy-tag-1 demo-policy-tag-2 --tag multiple-policies=demo-policy --org demo-cpln-organization
    ```

    ```text Output theme={null}
    +------------------+------------------+--------+------------+--------+--------+--------------------------------+
    |NAME              |DESCRIPTION       |CREATED |TARGET KIND |MATCHES |ORIGIN  |TAGS                            |
    |------------------|------------------|--------|------------|--------|--------|--------------------------------|
    |demo-policy-tag-1 |demo-policy-tag-1 |Now     |org         |all     |default |multiple-policies="demo-policy" |
    |demo-policy-tag-2 |demo-policy-tag-2 |Now     |org         |all     |default |multiple-policies="demo-policy" |
    +------------------+------------------+--------+------------+--------+--------+--------------------------------+
    ```
  </CodeGroup>

  * Remove same tag from multiple policies (after running the example above)

  <CodeGroup>
    ```bash Command theme={null}
    cpln policy tag demo-policy-tag-1 demo-policy-tag-2 --remove multiple-policies --org demo-cpln-organization
    ```

    ```text Output theme={null}
    +------------------+------------------+--------+------------+--------+--------+-----+
    |NAME              |DESCRIPTION       |CREATED |TARGET KIND |MATCHES |ORIGIN  |TAGS |
    |------------------|------------------|--------|------------|--------|--------|-----|
    |demo-policy-tag-1 |demo-policy-tag-1 |Now     |org         |all     |default |     |
    |demo-policy-tag-2 |demo-policy-tag-2 |Now     |org         |all     |default |     |
    +------------------+------------------+--------+------------+--------+--------+-----+
    ```
  </CodeGroup>
</Accordion>

***

#### policy update

Update properties of the referenced policy

**Usage**

```none theme={null}
cpln policy update <ref> --set UPDATE_PROPERTY [OPTIONS]
```

<Accordion title="Reference">
  ```text theme={null}
  Positionals:
    ref  The resource reference. Usually it is the name of the resource.  [required]

  Update Properties:
    --set    Update the following properties (e.g., --set description="Updated Description"):

             description    string
             tags.<key>     string
             targetLinks    string[]
             target         { 'all' }

             Arrays can be appended to, replaced, or removed using the `+=`, `=`, or `-=` operators, respectively.
    --unset  Unset a property (same paths as --set, e.g., --unset description)

  Context options:
    --profile  Override the profile. The default profile can be set using the `cpln profile set-default` command or by setting the CPLN_PROFILE environment variable
    --org      Override the organization. The default organization can be set in your profile by using the `cpln profile update` command

  Format options:
    --output, -o  Set the output format  [choices: "text", "json", "yaml", "json-slim", "yaml-slim", "tf", "crd", "names"]
    --color       Colorize the output  [boolean] [default: true]
    --ts          Timestamp format if the output format is text (e.g., --output=text)  [choices: "iso", "local", "age"]
    --max         Maximum number of records to show. A value less than 1 will return all records.  [number] [default: 50]

  Request options:
    --token         Override the authorization token
    --endpoint      Override the API URL
    --insecure, -k  Ignore TLS errors  [boolean]

  Debug options:
    --verbose, -v  Enable verbose output to stderr  [boolean] [default: false]
    --debug, -d    Show all HTTP communications  [boolean] [default: false]

  Options:
    --help  Show help  [boolean]
  ```

  [Common Options Reference](/cli-reference/using-cli/common-options)
</Accordion>

<Accordion title="Options">
  * The `--set` option allows the modification of the following policy properties:
    * `description`
      * Description of the policy
      * Type: string
    * `tags`
      * Tags (key=value) associated with the policy
      * Type: string
    * `targetLinks`
      * Array of target links belonging to the policy
      * Type: string
    * `target`
      * The target of the policy
      * Type: string
      * Allowed values: 'all'
</Accordion>

<Accordion title="Example">
  * For the examples below, the initial policy is configured as:

  ```
  +------------+------------+--------+------------+--------+--------+--------------+
  |NAME        |DESCRIPTION |CREATED |TARGET KIND |MATCHES |ORIGIN  |TAGS          |
  |------------|------------|--------|------------|--------|--------|--------------|
  |demo-policy |demo-policy |Now     |org         |all     |default |drink="water" |
  +------------+------------+--------+------------+--------+--------+--------------+
  ```

  * Update a policy's description

  <CodeGroup>
    ```bash Command theme={null}
    cpln policy update demo-policy --set description="new description" --org demo-cpln-organization
    ```

    ```text Output theme={null}
    +------------+----------------+--------------+------------+--------+--------+--------------+
    |NAME        |DESCRIPTION     |CREATED       |TARGET KIND |MATCHES |ORIGIN  |TAGS          |
    |------------|----------------|--------------|------------|--------|--------|--------------|
    |demo-policy |new description |8 minutes ago |org         |all     |default |drink="water" |
    +------------+----------------+--------------+------------+--------+--------+--------------+
    ```
  </CodeGroup>

  * Update a policy's tags

  <CodeGroup>
    ```bash Command theme={null}
    cpln policy update demo-policy --set tags.demo-key=demo-value --org demo-cpln-organization
    ```

    ```text Output theme={null}
    +------------+----------------+--------------+------------+--------+--------+----------------------+
    |NAME        |DESCRIPTION     |CREATED       |TARGET KIND |MATCHES |ORIGIN  |TAGS                  |
    |------------|----------------|--------------|------------|--------|--------|----------------------|
    |demo-policy |new description |8 minutes ago |org         |all     |default |demo-key="demo-value" |
    |            |                |              |            |        |        |drink="water"         |
    +------------+----------------+--------------+------------+--------+--------+----------------------+
    ```
  </CodeGroup>

  * Add to a policy's target links.

  <CodeGroup>
    ```bash Command theme={null}
    cpln policy update demo-policy --set targetLinks+="/org/demo-cpln-organization/gvc/demo-gvc-policy" --org demo-cpln-organization
    ```

    ```text Output theme={null}
    +------------+----------------+--------------+------------+--------+--------+----------------------+
    |NAME        |DESCRIPTION     |CREATED       |TARGET KIND |MATCHES |ORIGIN  |TAGS                  |
    |------------|----------------|--------------|------------|--------|--------|----------------------|
    |demo-policy |new description |8 minutes ago |org         |all     |default |demo-key="demo-value" |
    |            |                |              |            |        |        |drink="water"         |
    +------------+----------------+--------------+------------+--------+--------+----------------------+
    ```
  </CodeGroup>

  * Remove from a policy's target links.

  <CodeGroup>
    ```bash Command theme={null}
    cpln policy update demo-policy --set targetLinks-="/org/demo-cpln-organization/gvc/demo-gvc-policy" --org demo-cpln-organization
    ```

    ```text Output theme={null}
    +------------+----------------+--------------+------------+--------+--------+----------------------+
    |NAME        |DESCRIPTION     |CREATED       |TARGET KIND |MATCHES |ORIGIN  |TAGS                  |
    |------------|----------------|--------------|------------|--------|--------|----------------------|
    |demo-policy |new description |8 minutes ago |org         |all     |default |demo-key="demo-value" |
    |            |                |              |            |        |        |drink="water"         |
    +------------+----------------+--------------+------------+--------+--------+----------------------+
    ```
  </CodeGroup>

  * Update a policy's target to all

  <CodeGroup>
    ```bash Command theme={null}
    cpln policy update demo-policy --set target=all --org demo-cpln-organization
    ```

    ```text Output theme={null}
    +------------+----------------+--------------+------------+--------+--------+----------------------+
    |NAME        |DESCRIPTION     |CREATED       |TARGET KIND |MATCHES |ORIGIN  |TAGS                  |
    |------------|----------------|--------------|------------|--------|--------|----------------------|
    |demo-policy |new description |8 minutes ago |org         |all     |default |demo-key="demo-value" |
    |            |                |              |            |        |        |drink="water"         |
    +------------+----------------+--------------+------------+--------+--------+----------------------+
    ```
  </CodeGroup>
</Accordion>

***