> For the complete documentation index, see [llms.txt](https://codemash.gitbook.io/codemash/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://codemash.gitbook.io/codemash/cloud/membership/policies/new.md).

# Create a policy

Create a policy — a named set of permission statements written as one JSON document.

**Where:** Membership → Policies → **Add New** · `/projects/<project>/membership/policies/new`

## Before you start

* You know which module, action and items the policy should cover — see [Permissions](/codemash/cloud/concepts/permissions.md).
* You need the `membership:create` permission on policies.

## Steps

1. Press **Add New**. The screen **Add New Custom Policy** opens with one editor, **Policy document**, already holding a valid example: `My Policy`, which allows `database:Read` on every collection of this project. Your account id and project id are already in it.

   <figure><img src="https://712692422-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHy372bqsaex2cqS3ikhL%2Fuploads%2Fgit-blob-e25fcab657985f1681ed390ad9f44788c8f09f20%2Fpolicies-new-1.png?alt=media" alt="Add New Custom Policy with the example document: version 2026-09-17, name My Policy, one statement allowing database:Read on acc_3ldBfUc0Q6qRtAnwbE7Qsj:pr_5ArJCRo2mJ90H2Fp1oU6ta:database:collection:*, and the message Policy document is valid against the schema"><figcaption><p>The editor with the example document.</p></figcaption></figure>
2. Write the policy. The editor checks it against the schema while you type and shows the result under the editor.

   | Key                       | Required | What it does                                                                                                                   | Example                                                                           |
   | ------------------------- | -------- | ------------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------- |
   | `version`                 | yes      | The schema version.                                                                                                            | `2026-09-17`                                                                      |
   | `name`                    | yes      | The policy name; **Save** stays off without it.                                                                                | `orders-read`                                                                     |
   | `description`             | no       | What the policy is for.                                                                                                        | `Read every order in the database.`                                               |
   | `permissions`             | yes      | A list of statements.                                                                                                          | see below                                                                         |
   | `permissions[].sid`       | no       | A name for the statement.                                                                                                      | `Statement1`                                                                      |
   | `permissions[].effect`    | yes      | `Allow` or `Deny`.                                                                                                             | `Allow`                                                                           |
   | `permissions[].actions`   | yes      | Module and action.                                                                                                             | `database:Read`                                                                   |
   | `permissions[].resources` | yes      | `<account>:<project>:<module>:<kind>:<name>`; `*` is allowed in the last parts. The account part must be your real account id. | `acc_3ldBfUc0Q6qRtAnwbE7Qsj:pr_5ArJCRo2mJ90H2Fp1oU6ta:database:collection:orders` |

   <figure><img src="https://712692422-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHy372bqsaex2cqS3ikhL%2Fuploads%2Fgit-blob-fca734db3628439d4cbc189a3abfe2b1dc057fcd%2Fpolicies-new-2.png?alt=media" alt="The editor with the orders-read document: Allow database:Read on the orders collection; Policy document is valid against the schema"><figcaption><p>The <code>orders-read</code> policy, valid.</p></figcaption></figure>
3. Press **Save**.

{% hint style="info" %}
`acc_*` in the account part is refused on save (*Account segment 'acc\_\*' is not a valid account id*, `CM-ERRORS-MEMBERSHIP-019`). Keep the account id the editor puts in.
{% endhint %}

## Result

Cloud goes back to **Policies** and the policy is under **Custom Policies**. It gets an id like `pol_1oRlzIGnF3lzemVoX1nwyy` and can be attached to [roles](/codemash/cloud/membership/roles/new.md).

<figure><img src="https://712692422-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHy372bqsaex2cqS3ikhL%2Fuploads%2Fgit-blob-9b6071c5198f3f8348d22be5339557882891ad1b%2Fpolicies-new-3.png?alt=media" alt="Custom Policies list with content-editing, temp-policy and orders-read"><figcaption><p>The new policy in the list.</p></figcaption></figure>

## Change or remove it later

* **Edit** — [Edit a policy](/codemash/cloud/membership/policies/edit.md).
* **Delete** — [Delete a policy](/codemash/cloud/membership/policies/delete.md).

## Do it from code

```ts
const accountId = 'acc_3ldBfUc0Q6qRtAnwbE7Qsj'; // your account id — the policy editor in Cloud shows it
const document = {
  version: '2026-09-17',
  name: 'invoices-read',
  description: 'Read every invoice in the database.',
  permissions: [{ sid: 'Statement1', effect: 'Allow', actions: ['database:Read'],
    resources: [`${accountId}:${projectId}:database:collection:invoices`] }],
};
const { id } = await norbix.hub.membership.createPolicy({
  policyName: document.name,
  description: document.description,
  policyDocumentJson: JSON.stringify(document),
});
console.log(id); // pol_…
```

```sh
norbix hub membership policy create --policyName drafts-read --description 'Read drafts.' --policyDocumentJson '{"version":"2026-09-17","name":"drafts-read","description":"Read drafts.","permissions":[{"sid":"S1","effect":"Allow","actions":["database:Read"],"resources":["acc_3ldBfUc0Q6qRtAnwbE7Qsj:pr_5ArJCRo2mJ90H2Fp1oU6ta:database:collection:drafts"]}]}'
```

The client setup is on the [Membership page](/codemash/cloud/membership.md#use-it-from-code). API: [Create Policy](/codemash/api-reference/membership/policies/create-policy.md)