Policy schema

PolicyRule

A PolicyRule is a flat object. The request matchers shared with transformation and routing rules (CommonConditions) are promoted onto the rule body, so there is no nested match wrapper.

Match semantics

• A populated field is a constraint. Empty fields are wildcards and do not constrain.
• All populated fields must match for the rule to fire (logical AND across fields). Within a single array, values are OR-ed.
• SUPI / GPSI / DNN / S-NSSAI are extracted from the request URI and/or body where applicable. supi_ranges entries take start/end or a pattern; snssais entries take sst (and optional sd).
• SBI-only fields (path_patterns, methods, source_nf_types, target_nf_types, snssais, visited_plmns) and Diameter-only fields (avps, command_codes, diameter_apps, origin_realms, …) coexist; a rule that populates only SBI fields will never match a Diameter request.

Evaluation order

Rules are evaluated by priority ascending (lower priority first), with equal priorities broken by name ascending for deterministic ordering across restarts and replicas. The first matching rule decides allow or deny. See Policy engine for the model.

AVPMatcher (Diameter)

An AVPMatcher matches a single AVP by code + vendor_id against a set of allowed string values and/or a regex on the value's string form. At least one of equals or regex must be set. Command and application matching live on the rule itself (command_codes / diameter_apps), not on the matcher.

Each AVPMatcher supports:

• code — the AVP code (required).
• vendor_id — vendor ID; omit or 0 for base protocol.
• equals — array of allowed values; the AVP matches if it equals any of them (any-of).
• regex — RE2 match on the AVP's string form. OR-ed with equals.

Multiple AVPMatcher entries on a rule are AND-ed. Values are coerced to their string form before matching: OctetString as hex (e.g. 0x24f520), UTF8String / DiameterIdentity as the raw string, and Unsigned32 / Integer32 / Enumerated as a decimal string. Scalar AVPs only — grouped AVPs are skipped on the lookup walk.

RateLimitRule

key selects the bucket dimension. One of:

• "" — default: per source IP for SBI, per Origin-Host for Diameter.
• global — a single cluster-wide bucket.
• diameter_origin_host — per Origin-Host.
• diameter_origin_realm — per Origin-Realm.
• diameter_app_id — per Diameter application ID.
• diameter_command_code — per Diameter command code.
• imsi_prefix:N — first N digits of the IMSI (e.g. imsi_prefix:6 = MCC+MNC).

See Configuring rate limiting for the operator patterns and cardinality caveats.

Full policy document

d3x-edgectl policy returns the full PolicyConfig document, which bundles every block above alongside the OAuth2/JWT settings and the transformation and routing rules:

Transformation and routing rule shapes are documented in Transformation schema and Routing schema. The policy document is read-only — individual records are created and updated through the per-resource commands in Admin API → Policy.

Validation

Shape-and-semantic checks run on every write to the control-plane store, so an invalid rule is rejected at update time rather than at request time. To validate a full configuration without committing it, run d3x-edgectl validate config against a config file. See d3x-edgectl reference.

Where to go next

• Policy engine — how rules are evaluated.
• Admin API → Policy — the endpoints that read and write these records.
• Configuring rate limiting — rate-limit rules in practice.