agentcore-cli 0.31.1__py3-none-any.whl

agentcore/primitives/policy.py

@@ -0,0 +1,622 @@
+"""Cedar policy add/remove (port of src/cli/primitives/PolicyPrimitive.ts).
+
+Policies come from an inline statement, a file, natural-language generation (deployed engine
+required), or the guardrail form (``--form-*``), which synthesizes Cedar locally.
+"""
+
+import os
+from dataclasses import dataclass
+from typing import Any
+
+import typer
+
+from agentcore.aws import detect_region, policy_generation
+from agentcore.cli import interactive
+from agentcore.cli.commands.add._common import first_issue
+from agentcore.cli.errors import get_error_message
+from agentcore.cli.naming import generate_unique_name
+from agentcore.cli.run_command import run_cli_command
+from agentcore.lib import ResourceNotFoundError, ValidationError, find_config_root, serialize_result
+from agentcore.lib.errors.types import to_error
+from agentcore.lib.result import Err, Ok
+from agentcore.lib.schemas.io.config_io import to_jsonable
+from agentcore.primitives._policy_form import (
+    ENFORCEMENT_MODE_OPTIONS,
+    FILTERS_BY_CATEGORY,
+    GUARDRAIL_CATEGORY_OPTIONS,
+    POLICY_EFFECT_OPTIONS,
+    POLICY_SOURCE_METHOD_OPTIONS,
+    VALIDATION_MODE_OPTIONS,
+    GuardrailFormConfig,
+    authorization_phase_for_effect,
+    default_data_path_for_effect,
+    invalid_filters_for_category,
+    synthesize_cedar,
+)
+from agentcore.primitives.base import BasePrimitive, RemovableResource, RemovalPreview, SchemaChange, emit_json
+from agentcore.primitives.deployed_gateways import find_deployed_gateway, first_deployed_gateway
+from agentcore.schema import ENFORCEMENT_MODES, VALIDATION_MODES, PolicyName
+
+_ALLOWED_CATEGORIES = ("contentFilter", "promptAttack", "sensitiveInformation")
+
+
+@dataclass
+class AddPolicyOptions:
+    name: str
+    engine: str
+    description: str | None = None
+    statement: str | None = None
+    source: str | None = None
+    generate: str | None = None
+    gateway: str | None = None
+    validation_mode: str | None = None
+    enforcement_mode: str | None = None
+    authorization_phase: str | None = None
+
+
+def _parse_enum(value: str, allowed: tuple[str, ...]) -> str:
+    if value not in allowed:
+        expected = "|".join(f'"{v}"' for v in allowed)
+        raise ValueError(f"Invalid option: expected one of {expected}")
+    return value
+
+
+def _split_key(key: str) -> tuple[str | None, str]:
+    if "/" in key:
+        engine, _, policy = key.partition("/")
+        return engine, policy
+    return None, key
+
+
+class PolicyPrimitive(BasePrimitive):
+    kind = "policy"
+    label = "Policy"
+
+    def _project(self) -> dict[str, Any]:
+        return to_jsonable(self.read_project_spec())
+
+    # --- add ----------------------------------------------------------------------------
+
+    def add(self, options: AddPolicyOptions) -> Ok[dict[str, Any]] | Err[Exception]:
+        try:
+            if len([f for f in (options.statement, options.source, options.generate) if f]) > 1:
+                return Err(ValidationError("Only one of --statement, --source, or --generate can be provided."))
+
+            project = self._project()
+            engine = next((e for e in project["policyEngines"] if e["name"] == options.engine), None)
+            if engine is None:
+                return Err(ResourceNotFoundError(f'Policy engine "{options.engine}" not found.'))
+
+            self.check_duplicate([RemovableResource(p["name"]) for p in engine["policies"]], options.name, "Policy")
+
+            statement = options.statement or ""
+
+            if options.source and not statement:
+                if not os.path.exists(options.source):
+                    return Err(ResourceNotFoundError(f"Source file not found: {options.source}"))
+                with open(options.source, encoding="utf-8") as fh:
+                    statement = fh.read().strip()
+                if not statement:
+                    return Err(ValidationError(f"Source file is empty: {options.source}"))
+
+            if options.generate and not statement:
+                state = self.config_io.read_deployed_state()
+                engine_id: str | None = None
+                for target in (state.targets or {}).values():
+                    engines = (target.resources.policy_engines if target.resources else None) or {}
+                    if engine_id is None and options.engine in engines:
+                        engine_id = engines[options.engine].policy_engine_id
+
+                gateway = (
+                    find_deployed_gateway(state, options.gateway) if options.gateway else first_deployed_gateway(state)
+                )
+                gateway_arn = gateway.gateway_arn if gateway is not None else None
+
+                if not engine_id:
+                    return Err(
+                        ValidationError(
+                            f'Policy engine "{options.engine}" is not deployed. Run `agentcore deploy` first.'
+                        )
+                    )
+                if options.gateway and not gateway_arn:
+                    return Err(ResourceNotFoundError(f'Gateway "{options.gateway}" not found in deployed state.'))
+                if not gateway_arn:
+                    return Err(
+                        ResourceNotFoundError(
+                            "No deployed gateway found. Policy generation requires a deployed gateway. "
+                            "Use --gateway <name> to specify one."
+                        )
+                    )
+                statement = self._generate(engine_id, options.generate, gateway_arn)
+
+            if not statement:
+                return Err(ValidationError("Either --statement, --source, or --generate is required."))
+
+            policy: dict[str, Any] = {"name": options.name}
+            if options.description:
+                policy["description"] = options.description
+            policy["statement"] = statement
+            if options.source:
+                policy["sourceFile"] = options.source
+            policy["validationMode"] = options.validation_mode or "FAIL_ON_ANY_FINDINGS"
+            policy["enforcementMode"] = options.enforcement_mode or "ACTIVE"
+            if options.authorization_phase:
+                policy["authorizationPhase"] = options.authorization_phase
+
+            engine["policies"].append(policy)
+            self.write_project_spec(project)
+            return Ok({"policyName": options.name, "engineName": options.engine})
+        except Exception as exc:  # noqa: BLE001
+            return Err(to_error(exc))
+
+    @staticmethod
+    def _generate(engine_id: str, description: str, gateway_arn: str) -> str:
+        region = detect_region().region
+        start = policy_generation.start_policy_generation(
+            policy_engine_id=engine_id, description=description, region=region, resource_arn=gateway_arn
+        )
+        result = policy_generation.get_policy_generation(
+            generation_id=start["generationId"], policy_engine_id=engine_id, region=region
+        )
+        return result["statement"]
+
+    # --- remove -------------------------------------------------------------------------
+
+    def remove(self, name: str, engine_name: str | None = None) -> Ok[None] | Err[Exception]:
+        """Remove by composite key ``engine/policy`` or by policy name (+ optional engine)."""
+        try:
+            project = self._project()
+            resolved_engine, resolved_policy = engine_name, name
+            if not resolved_engine and "/" in name:
+                resolved_engine, resolved_policy = _split_key(name)
+
+            if not resolved_engine:
+                matching = [
+                    e for e in project["policyEngines"] if any(p["name"] == resolved_policy for p in e["policies"])
+                ]
+                if len(matching) > 1:
+                    return Err(
+                        ValidationError(
+                            f'Policy "{resolved_policy}" exists in multiple engines: '
+                            f"{', '.join(e['name'] for e in matching)}. Use --engine to specify which one."
+                        )
+                    )
+
+            for engine in project["policyEngines"]:
+                if resolved_engine and engine["name"] != resolved_engine:
+                    continue
+                index = next((i for i, p in enumerate(engine["policies"]) if p["name"] == resolved_policy), -1)
+                if index != -1:
+                    engine["policies"].pop(index)
+                    self.write_project_spec(project)
+                    return Ok(None)
+
+            suffix = f' in engine "{resolved_engine}"' if resolved_engine else ""
+            return Err(ResourceNotFoundError(f'Policy "{resolved_policy}" not found{suffix}.'))
+        except Exception as exc:  # noqa: BLE001
+            return Err(to_error(exc))
+
+    def preview_remove(self, name: str) -> RemovalPreview:
+        project = self._project()
+        target_engine, target_policy = _split_key(name)
+
+        if not target_engine:
+            matching = [e for e in project["policyEngines"] if any(p["name"] == target_policy for p in e["policies"])]
+            if len(matching) > 1:
+                raise Exception(
+                    f'Policy "{target_policy}" exists in multiple engines: '
+                    f"{', '.join(e['name'] for e in matching)}. Use --engine to specify which one."
+                )
+
+        for engine in project["policyEngines"]:
+            if target_engine and engine["name"] != target_engine:
+                continue
+            if any(p["name"] == target_policy for p in engine["policies"]):
+                after = {
+                    **project,
+                    "policyEngines": [
+                        e
+                        if e["name"] != engine["name"]
+                        else {**e, "policies": [p for p in e["policies"] if p["name"] != target_policy]}
+                        for e in project["policyEngines"]
+                    ],
+                }
+                return RemovalPreview(
+                    [f"Removing policy: {target_policy} (from engine {engine['name']})"],
+                    [],
+                    [SchemaChange("agentcore/agentcore.json", project, after)],
+                )
+
+        suffix = f' in engine "{target_engine}"' if target_engine else ""
+        raise Exception(f'Policy "{target_policy}" not found{suffix}.')
+
+    def get_removable(self) -> list[RemovableResource]:
+        try:
+            return [
+                RemovableResource(f"{e['name']}/{p['name']}", {"engineName": e["name"]})
+                for e in self._project()["policyEngines"]
+                for p in e["policies"]
+            ]
+        except Exception:  # noqa: BLE001
+            return []
+
+    # --- CLI ----------------------------------------------------------------------------
+
+    def register_commands(self, add_app: typer.Typer, remove_app: typer.Typer) -> None:
+        @add_app.command("policy", help="Add a policy to a policy engine")
+        def add_policy(
+            name: str | None = typer.Option(None, "--name", help="Policy name [non-interactive]"),
+            engine: str | None = typer.Option(None, "--engine", help="Policy engine name [non-interactive]"),
+            description: str | None = typer.Option(None, "--description", help="Policy description [non-interactive]"),
+            source: str | None = typer.Option(None, "--source", help="Path to a policy file [non-interactive]"),
+            statement: str | None = typer.Option(None, "--statement", help="Policy statement [non-interactive]"),
+            generate: str | None = typer.Option(
+                None,
+                "-g",
+                "--generate",
+                help="Generate policy from natural language description [non-interactive]",
+            ),
+            gateway: str | None = typer.Option(
+                None, "--gateway", help="Deployed gateway name for policy generation [non-interactive]"
+            ),
+            target: str | None = typer.Option(
+                None, "--target", help="Gateway target name for Cedar action scope [non-interactive]"
+            ),
+            form_category: str | None = typer.Option(
+                None,
+                "--form-category",
+                help="Guardrail category: contentFilter, promptAttack, or sensitiveInformation [non-interactive]",
+            ),
+            form_filters: str | None = typer.Option(
+                None, "--form-filters", help="Comma-separated filters for the chosen category [non-interactive]"
+            ),
+            form_effect: str | None = typer.Option(
+                None,
+                "--form-effect",
+                help="Policy effect: forbid, permit, or suppressOutput (default: forbid) [non-interactive]",
+            ),
+            form_data_path: str | None = typer.Option(
+                None,
+                "--form-data-path",
+                help="Data path to evaluate, e.g. context.input.prompt (default: context.input.prompt) "
+                "[non-interactive]",
+            ),
+            validation_mode: str | None = typer.Option(
+                None,
+                "--validation-mode",
+                help="Validation mode: FAIL_ON_ANY_FINDINGS or IGNORE_ALL_FINDINGS [non-interactive]",
+            ),
+            enforcement_mode: str | None = typer.Option(
+                None,
+                "--enforcement-mode",
+                help="Enforcement mode: ACTIVE (enforce decisions) or LOG_ONLY (shadow mode) (default: ACTIVE) "
+                "[non-interactive]",
+            ),
+            as_json: bool = typer.Option(False, "--json", help="Output as JSON [non-interactive]"),
+        ) -> None:
+            if not find_config_root():
+                typer.echo("No agentcore project found. Run `agentcore create` first.", err=True)
+                raise typer.Exit(1)
+
+            if not (name or engine or source or statement or generate or form_category or as_json):
+                try:
+                    interactive.require_tty()
+                    self.add_interactive()
+                except typer.Exit:
+                    raise
+                except Exception as exc:  # noqa: BLE001
+                    typer.echo(get_error_message(exc), err=True)
+                    raise typer.Exit(1) from None
+                raise typer.Exit(0)
+
+            def run() -> None:
+                if not name:
+                    raise Exception("--name is required")
+                if not engine:
+                    raise Exception("--engine is required")
+                if len([f for f in (statement, source, generate, form_category) if f]) > 1:
+                    raise Exception("Only one of --statement, --source, --generate, or --form-* can be provided.")
+                if enforcement_mode and enforcement_mode not in ENFORCEMENT_MODES:
+                    raise Exception("Invalid --enforcement-mode. Use ACTIVE or LOG_ONLY.")
+
+                options = AddPolicyOptions(
+                    name=name,
+                    engine=engine,
+                    description=description,
+                    source=source,
+                    statement=statement,
+                    generate=generate,
+                    gateway=gateway,
+                    validation_mode=_parse_enum(validation_mode, VALIDATION_MODES) if validation_mode else None,
+                    enforcement_mode=enforcement_mode or None,
+                    authorization_phase="INITIATE",
+                )
+
+                if form_category:
+                    options.statement, options.authorization_phase = self._synthesize_from_flags(
+                        form_category, form_filters, form_effect, form_data_path, gateway, target
+                    )
+
+                result = self.add(options)
+                if not result.success:
+                    raise result.error
+                if as_json:
+                    emit_json(serialize_result(result))
+                else:
+                    typer.echo(f"Added policy '{result.value['policyName']}' to engine '{result.value['engineName']}'")
+
+            run_cli_command(as_json, run)
+
+        @remove_app.command("policy", help="Remove a policy from a policy engine")
+        def remove_policy(
+            name: str | None = typer.Option(None, "--name", help="Name of policy to remove [non-interactive]"),
+            engine: str | None = typer.Option(None, "--engine", help="Policy engine name [non-interactive]"),
+            yes: bool = typer.Option(False, "-y", "--yes", help="Skip confirmation prompt [non-interactive]"),
+            as_json: bool = typer.Option(False, "--json", help="Output as JSON [non-interactive]"),
+        ) -> None:
+            if (name or yes or as_json) and not name and not as_json:
+                # Upstream prints a plain message (not JSON) here when --json is absent.
+                if find_config_root():
+                    typer.echo("--name is required", err=True)
+                    raise typer.Exit(1)
+            from agentcore.primitives.policy_engine import PRIMITIVE as engine_primitive
+
+            key = f"{engine}/{name}" if engine and name else None
+            engine_primitive._run_remove_with_text.__func__(self, name, yes, as_json, key)  # type: ignore[attr-defined]
+
+    def _synthesize_from_flags(
+        self,
+        category: str,
+        filters_raw: str | None,
+        effect_raw: str | None,
+        data_path: str | None,
+        gateway: str | None,
+        target: str | None,
+    ) -> tuple[str, str]:
+        if not filters_raw:
+            raise Exception("--form-filters is required when --form-category is specified.")
+        if category not in _ALLOWED_CATEGORIES:
+            raise Exception(f"Unknown category: {category}. Allowed: {', '.join(_ALLOWED_CATEGORIES)}")
+        effect = effect_raw or "forbid"
+        if effect not in ("permit", "forbid", "suppressOutput"):
+            raise Exception("Invalid --form-effect. Use permit, forbid, or suppressOutput.")
+        filters = [s.strip() for s in filters_raw.split(",")]
+        invalid = invalid_filters_for_category(category, filters)
+        if invalid:
+            raise ValidationError(
+                f"Invalid filter(s) for category '{category}': {', '.join(invalid)}. "
+                f"Allowed: {', '.join(FILTERS_BY_CATEGORY[category])}"
+            )
+
+        gateway_arn: str | None = None
+        target_name = target
+        if gateway:
+            try:
+                state = self.config_io.read_deployed_state()
+                deployed = find_deployed_gateway(state, gateway)
+                if deployed is not None and deployed.gateway_arn:
+                    gateway_arn = deployed.gateway_arn
+                    if not target_name:
+                        names = list((deployed.targets or {}).keys())
+                        if len(names) > 1:
+                            raise ValidationError(
+                                f'Multiple targets found on gateway "{gateway}": {", ".join(names)}. '
+                                "Use --target <name> to specify one."
+                            )
+                        target_name = names[0] if names else None
+            except ValidationError:
+                raise
+            except Exception:  # noqa: BLE001 - deployed state unavailable; ARN is omitted
+                pass
+
+        statement = synthesize_cedar(
+            GuardrailFormConfig(category, filters, effect, data_path or default_data_path_for_effect(effect)),
+            target_name=target_name,
+            gateway_arn=gateway_arn,
+        )
+        return statement, authorization_phase_for_effect(effect)
+
+    # --- interactive (AddPolicyFlow / AddPolicyScreen) ----------------------------------
+
+    def add_interactive(self) -> None:
+        from agentcore.primitives.policy_engine import PRIMITIVE as engine_primitive
+
+        engines = engine_primitive.get_existing_engines()
+        if not engines:
+            engine_name = engine_primitive.run_engine_wizard(engines)
+            if not interactive.confirm("Add a policy to this engine?", default=True):
+                return
+            self.run_policy_wizard(engine_name, [*engines, engine_name])
+            return
+        choice = interactive.select(
+            "Add Policy",
+            [interactive.Choice(n, n, "Add a policy") for n in engines]
+            + [interactive.Choice("Create a new policy engine", "__create_new__")],
+        )
+        if choice == "__create_new__":
+            engine_name = engine_primitive.run_engine_wizard(engines)
+            if not interactive.confirm("Add a policy to this engine?", default=True):
+                return
+            self.run_policy_wizard(engine_name, [*engines, engine_name])
+        else:
+            self.run_policy_wizard(choice, engines)
+
+    def run_policy_wizard(self, engine_name: str, existing_engines: list[str]) -> None:
+        """Question order of useAddPolicyWizard with a pre-selected engine."""
+        from agentcore.primitives.policy_engine import PRIMITIVE as engine_primitive
+
+        deployed_id = engine_primitive.get_deployed_engine_id(engine_name)
+        deployed_gateways = engine_primitive.get_deployed_gateways()
+        project_gateways = engine_primitive.get_project_gateways()
+        is_engine_deployed = deployed_id is not None and len(deployed_gateways) > 0
+
+        gateway_name = ""
+        target_name = ""
+        if deployed_gateways:
+            gateway_name = interactive.select(
+                "Select a deployed gateway (choose which gateway this policy will apply to)",
+                [interactive.Choice(n, n, arn.split(":")[-1]) for n, arn in deployed_gateways.items()],
+            )
+            gw = next((g for g in project_gateways if g["name"] == gateway_name), None)
+            targets = gw["httpTargets"] if gw else []
+            if targets:
+                target_name = interactive.select(
+                    f'Select an HTTP runtime target (targets on gateway "{gateway_name}")',
+                    [interactive.Choice(t, t, "HTTP runtime target") for t in targets],
+                )
+
+        existing_policies = [
+            p["name"] for e in self._project()["policyEngines"] if e["name"] == engine_name for p in e["policies"]
+        ]
+
+        def validate_name(value: str) -> str | None:
+            return first_issue(PolicyName, value) or (
+                "Policy name already exists" if value in existing_policies else None
+            )
+
+        name = interactive.text(
+            "Policy name", default=generate_unique_name("MyPolicy", existing_policies), validate=validate_name
+        )
+
+        method = interactive.select(
+            "How would you like to define the policy?",
+            [
+                interactive.Choice(
+                    o.title,
+                    o.id,
+                    "Deploy engine first" if o.id == "generate" and not is_engine_deployed else o.description,
+                    disabled="Deploy engine first" if o.id == "generate" and not is_engine_deployed else None,
+                )
+                for o in POLICY_SOURCE_METHOD_OPTIONS
+            ],
+        )
+
+        statement = ""
+        source_file = ""
+        authorization_phase = "INITIATE"
+        source_display = "(inline statement)"
+        if method == "file":
+            source_file = interactive.text("Path to policy file (.cedar)")
+            source_display = source_file
+        elif method == "inline":
+            statement = interactive.text("Enter policy statement")
+        elif method == "generate":
+            statement, description = self._interactive_generate(engine_name, deployed_gateways)
+            source_display = f'Generated from: "{description}"'
+        elif method == "form":
+            statement, effect, form = self._interactive_form(
+                target_name, deployed_gateways.get(gateway_name) if gateway_name else None
+            )
+            authorization_phase = authorization_phase_for_effect(effect)
+            source_display = f"Form: {form.category} ({len(form.filters)} filters)"
+
+        enforcement = interactive.select(
+            "Enforcement mode (should this policy actively enforce decisions or only log them?)",
+            [interactive.Choice(o.title, o.id, o.description) for o in ENFORCEMENT_MODE_OPTIONS],
+        )
+        validation = interactive.select(
+            "Validation mode (how to handle analyzer validation findings)",
+            [interactive.Choice(o.title, o.id, o.description) for o in VALIDATION_MODE_OPTIONS],
+        )
+
+        typer.echo(f"  Engine: {engine_name}")
+        typer.echo(f"  Name: {name}")
+        typer.echo(f"  Policy source: {source_display}")
+        typer.echo(f"  Enforcement: {'Active' if enforcement == 'ACTIVE' else 'Log only'}")
+        typer.echo(
+            f"  Validation: {'Fail on any findings' if validation == 'FAIL_ON_ANY_FINDINGS' else 'Ignore all findings'}"
+        )
+        if not interactive.confirm("Confirm?", default=True):
+            typer.echo("Cancelled.")
+            return
+
+        result = self.add(
+            AddPolicyOptions(
+                name=name,
+                engine=engine_name,
+                statement=statement,
+                source=source_file or None,
+                validation_mode=validation,
+                enforcement_mode=enforcement,
+                authorization_phase=authorization_phase,
+            )
+        )
+        if not result.success:
+            typer.echo("Failed to add policy resource", err=True)
+            raise result.error
+        typer.echo(f"Added policy: {name}")
+        typer.echo(f"Policy added to engine '{engine_name}'. Deploy with `agentcore deploy` to apply.")
+
+    def _interactive_generate(self, engine_name: str, deployed_gateways: dict[str, str]) -> tuple[str, str]:
+        from agentcore.primitives.policy_engine import PRIMITIVE as engine_primitive
+
+        gateway_arn = interactive.select(
+            "Select a deployed gateway (choose which gateway this policy will apply to)",
+            [interactive.Choice(n, arn, arn.split(":")[-1]) for n, arn in deployed_gateways.items()],
+        )
+        description = ""
+        while True:
+            description = interactive.text("Describe your policy in natural language", default=description)
+            typer.echo("Generating policy from description...")
+            try:
+                engine_id = engine_primitive.get_deployed_engine_id(engine_name)
+                if not engine_id:
+                    raise Exception("Policy engine is not deployed. Run `agentcore deploy` first.")
+                statement = self._generate(engine_id, description, gateway_arn)
+            except Exception as exc:  # noqa: BLE001
+                typer.echo(f"Generation failed: {get_error_message(exc)}", err=True)
+                continue
+            typer.echo("Generated policy:")
+            typer.secho(statement, fg="cyan")
+            if (
+                interactive.select(
+                    "What would you like to do?",
+                    [
+                        interactive.Choice("Accept generated policy", "accept", "Use this policy"),
+                        interactive.Choice("Regenerate", "regenerate", "Describe again and generate a new policy"),
+                    ],
+                )
+                == "accept"
+            ):
+                return statement, description
+
+    def _interactive_form(self, target_name: str, gateway_arn: str | None) -> tuple[str, str, GuardrailFormConfig]:
+        while True:
+            effect = interactive.select(
+                "Policy effect (should this policy forbid or permit matching content?)",
+                [interactive.Choice(o.title, o.id, o.description) for o in POLICY_EFFECT_OPTIONS],
+            )
+            category = interactive.select(
+                "Select guardrail category",
+                [interactive.Choice(o.title, o.id, o.description) for o in GUARDRAIL_CATEGORY_OPTIONS],
+            )
+            filters: list[str] = interactive.checkbox(
+                f"Select filters for {category}",
+                [interactive.Choice(f, f) for f in FILTERS_BY_CATEGORY[category]],
+            )
+            while not filters:
+                filters = interactive.checkbox(
+                    f"Select filters for {category} (select at least one)",
+                    [interactive.Choice(f, f) for f in FILTERS_BY_CATEGORY[category]],
+                )
+            data_path = interactive.text(
+                "Data path to evaluate (e.g. context.input.prompt, context.output.prompt)",
+                default=default_data_path_for_effect(effect),
+            )
+            form = GuardrailFormConfig(category, filters, effect, data_path)
+            cedar = synthesize_cedar(form, target_name=target_name or None, gateway_arn=gateway_arn)
+            typer.echo("Generated policy from guardrail form:")
+            typer.secho(cedar, fg="cyan")
+            typer.echo("Authorization phase: INITIATE (default)")
+            choice = interactive.select(
+                "What would you like to do?",
+                [
+                    interactive.Choice("Accept policy", "accept", "Use this generated policy"),
+                    interactive.Choice("Edit selections", "edit", "Go back and change filters/thresholds"),
+                ],
+            )
+            if choice == "accept":
+                return cedar, effect, form
+
+
+PRIMITIVE = PolicyPrimitive()