Skip to content
SkiMasque
Sign InGet Started

Turn workload identity into network access.

Policies define exactly what authenticated identities can access.

Get StartedRead the Docs

Policy model

Every policy answers four questions: who, what, where, and within what limits.

  1. WHOacme/widget · deploy-production
  2. WHATterraform
  3. WHEREdb.prod:5432
  4. LIMITS20m · 100 Mbps
    active
  5. NETWORK ACCESS ACCESS GRANTED
A policy answers four questions: who is asking, what they are running, where they want to go, and the limits on the access. The answer is network access.
WHO
acme/widget · main · deploy-production
WHAT
terraform
WHERE
db.prod:5432
LIMITS
20m · 100 Mbps

Policy decision

  1. Request
    evaluatedcontrol plane
  2. Policy
A request is evaluated by the policy.
  • matchactive
    Allow
  • no matchdenied
    DenyNo matching allow rule means DENY.
If a policy matches the request, access is allowed. With no matching allow rule the request is denied.

Default deny

No matching allow rule means DENY.
  1. REQUEST
  2. NO MATCH
    denied
  3. ACCESS DENIED
A request that matches no allow rule is denied.

Policy examples

Production deployment

.masque/policies/production.toml
name = "production"

[match]                       # WHO
repository = "acme/widget"
branch = "main"

[[rules]]
application = "terraform"     # WHAT
action = "allow"
destinations = [              # WHERE
    "api.production.example.com:443",
    "*.terraform.io:443",
]

[session]                     # LIMITS
max_duration = "20m"

[limits]
bandwidth = "100Mbps"
connections = 50

[[tests]]                     # runs in CI
application = "terraform"
destination = "api.production.example.com:443"
expect = "allow"

Developer database access

.masque/policies/developer-db.toml
name = "developer-db"

[match]                       # WHO
repository = "acme/platform"
branch = "main"

[[rules]]
application = "psql"          # WHAT
action = "allow"
destinations = ["dev-db.internal:5432"]   # WHERE

[session]                     # LIMITS
max_duration = "60m"

Policies are TOML or YAML files in your repository, so they can be reviewed, diffed and tested in CI.

Create and explain policies

The console wizard guides you through identity, application, destinations, limits and review. Save a draft, validate and test it, then publish a revision.

Start with:

Who needs access?
acme/widget
What are they running?
terraform
Where do they need to go?
db.prod:5432
How long?
20 minutes
Bandwidth limit?
100 Mbps

Review the generated policy before applying it.

Write a policy file or use the console wizard, then ask why a request is allowed or denied. Explanations include baseline guardrails. Verified workload kinds distinguish CI, developers and agents; application names remain declared context. Policy max_duration is currently metadata, not an enforced timeout.

Explain a denial, offline
skimasque policy check production google.com:443 --app terraform
DENY

Policy: production

Reason:
No matching allow rule.

Closest rules:
  api.production.example.com:443
  *.terraform.io:443

Suggested rule:

  allow terraform google.com:443