| access_not_revoked_since_grant | The “open session” idiom: a negated left operand on since expresses “has |
| alert_exactly_three_transfers | Counting over a *-wildcard field: permit an Alert only if exactly three |
| alert_heartbeat_and_login_rate | A top-level && chain combining a formerly with an exists-guarded count |
| alert_login_and_big_transfer | Nested exists with a value-threshold filter: permit an Alert when the |
| alert_login_current_tp | The canonical tp(t) count-over-timepoints idiom with no temporal wrapper |
| alert_login_in_last_hour | Counting over history: a formerly within 1h body inside the aggregation |
| alert_pending_transfers | Aggregate-vs-aggregate comparison (parenthesized left, bare right): permit an |
| alert_same_principal_login_transfer | An entity-typed exists binder that correlates on the request principal |
| alert_same_user_login_and_transfer | A shared exists variable joins two different predicates through a common |
| alert_some_login | exists is the sole quantifier: it asserts at least one satisfying |
| alert_total_transfer_over_200 | Aggregation example: permit an Alert only when the total transferred amount |
| allow_anything | An unconstrained (bare) scope triple: all three slots (principal, action, |
| approve_has_output_guard | The has attribute-existence guard before reading an optional Bool output |
| call_cedar_macro_as_argument | A Cedar macro call passed as an argument to another macro call: |
| call_cedar_macro_is_small | A def cedar macro called in an ordinary when { … } position: |
| call_cedar_macro_with_temporal_leaf | A Cedar macro conjoined mid-expression with a temporal { … } leaf. Because a |
| call_cedar_macros_composed | Two Cedar macros composed with && in one when { … } clause: |
| call_temporal_aggregation_macro_count | Calling a def temporal aggregation macro. count_formerly produces a |
| call_temporal_condition_macro_once | Calling a def temporal condition macro inside a when temporal { … } |
| call_temporal_condition_macros_composed | Two def temporal condition macros composed with && inside a single |
| cedar_eligible_not_blocked | Two def cedar macros of different argument types composed with && inside one |
| cedar_is_small_threshold | The simplest def cedar macro: is_small(?n) names the < 100 threshold so |
| cedar_macro_plus_temporal_leaf | A def cedar boolean macro (level_ok) conjoined mid-expression with an |
| cedar_semver_gt | The RFC 0061 semver worked example for Cedar macros: a record-building macro |
| cedar_starts_with_f_like | A Cedar macro whose body is a like wildcard pattern: starts_with_f(?s) |
| cedar_within_cap_if_else | A def cedar macro whose body is an if/then/else expression, encoding a |
| cond_is_oauth_in_team | The expression-level counterpart of the is / is-in scope constraint: an |
| deny_overrides_sell_not_amzn | A permit + forbid pair showing deny-overrides semantics: SellShares is |
| forbid_large_except_amzn | Mixing when and unless on a forbid rule: block large SellShares |
| forbid_read_transfers_over_1000 | A forbid rule with a sum over a (value, timepoint) domain and a filtered |
| get_amzn_stock_info | A plain (non-temporal) permit showing that an MCP-manifest input field |
| heartbeat_scope_alias | formerly with scope-alias correlation. Permit an Alert only if a |
| login_attempt_custom_kind | A custom, author-defined event kind. The per-case event schema |
| macro_library_once_is_small | Demonstrates the shareable macro library: the policy calls once (a |
| max_window_raised | Raising the temporal look-back cap. The event schema’s default cap on any |
| permit_read_anyone | The simplest useful rule: permit the Read action for any principal on any |
| principal_is_oauth | Demonstrates the principal is Type entity-type scope constraint: the policy |
| provider_allowed_or_short | Disjunction and parentheses over two information providers: permit Read when |
| provider_digitcount_forbid | A provider gating a forbid rule, alongside a catch-all permit – showing |
| provider_digitcount_operator_ge | The operator-form comparison example (>= on an integer provider output), |
| provider_filter_set_index_decimal | The guardrail flagship shape in one atom: a set argument |
| provider_int_arithmetic_trusted | A provider’s integer output used inside arithmetic, mixed under && with a |
| provider_matches_and_not_blocked | Two information providers combined with the boolean spine (&& and !) inside |
| provider_principal_id_allowlist | Permit Read only when the requesting principal is on the provider’s |
| provider_regex_analyze_fields | Several calls to the same Regex::Analyze provider, each projecting a |
| provider_regex_matches_uppercase | The canonical worked information-provider example: permit Read only when the |
| provider_risk_decimal_method | The decimal-extension-method comparison form. The Content::Risk provider |
| read_after_login | The history-dependent version of the getting-started tour (Step 4 — a decision that |
| read_after_login_success | Response predicate + output-field filter: permit a Read only if the **same |
| read_heartbeat_since_login_30s | since with a short (seconds) window: the anchor must be recent enough, or the |
| read_login_not_logout | The accepted “A but not B” idiom with restrictor-first conjunct ordering. |
| read_prev_compute_open_session | A top-level previous && (open-session since) chain: permit a Read only if the |
| read_prev_login | previous within 1h: permit a Read only if the immediately preceding |
| read_prev_login_success | previous with a response predicate and an output-field filter. |
| read_since_login | Positive-left since within 1h: the left operand must have **held |
| sell_after_2024_datetime | A single datetime literal compared with an ordinary comparison operator |
| sell_after_approval_valid_ticker | Two Dogwood clause forms combined on a single rule: |
| sell_comparison_chain | Several comparison operators chained in a single && conjunction on a Long. |
| sell_datetime_window | Datetime ordered comparison expressing a calendar-year time window: permit |
| sell_like_a_prefix | The like operator matches a string against a wildcard pattern, where * |
| sell_logical_grouping | Logical connectives ||, &&, and ! with parenthesized grouping to override |
| sell_nested_if_threshold | Nested if/then/else used as an operand rather than a top-level |
| sell_nonzero_proceeds_decimal | Decimal supports equality only (== / !=); ordered comparison on |
| sell_not_blocked_string | String inequality (!=) — one of the two operators strings support (== and |
| sell_not_test_tickers_like | The like string-pattern operator used under unless as a denylist idiom: a |
| sell_or_approve_action_in | action in [ ... ]: list-membership matching on the action. This rule permits |
| sell_shares_eq_scope | An == scope constraint pinning the action to a specific entity reference: this |
| sell_shares_temporal_subexpr | A temporal { ... } marker used as a sub-expression inside a larger Cedar |
| sell_small_only | The canonical five-part rule shape: annotation + effect + parenthesized scope |
| sell_small_proceeds_decimal_method | Decimal .lessThan(...) method call — how decimals are ordered. Cedar decimals |
| sell_threshold_by_stock | An if / then / else used as the whole body of a when clause reads like a |
| sell_two_when_small_amzn | Two when clauses stacked on one rule are implicitly conjoined: both must |
| sell_unless_huge | Basic unless { ... } clause: permit SellShares unless the order is |
| sell_when_under_100 | A basic when { ... } condition clause: a when body must evaluate true for |
| sell_when_unless_mix | Mixing when and unless clauses on a single permit rule. Because clauses |
| sell_zero_proceeds_if_has | The if C has attr then ... else false idiom guards an optional output field. |
| simplest_permit | The simplest possible policy: a bare permit for GetStockInfo with no |
| submit_after_approval_injection | A def temporal macro (approved_recently) whose predicate-valued parameter |
| temporal_count_formerly_login | An aggregation-flavoured temporal macro. count_formerly(?w, ?s) counts the |
| temporal_login_then_read | Two def temporal condition macros joined with && inside a single |
| temporal_once_read_recent | A condition-flavoured temporal macro. `def temporal once(?w, ?s) { formerly |
| temporal_sum_formerly_transfer | A temporal sum aggregation macro defined inline. sum_formerly combines a |
| traders_is_in_group_scope | The is Type in Group scope constraint: the principal slot both tests the |
| transfer_prev_nested_conj | previous’s body must be a single atom, so a conjunction has to be |
| write_after_read | The canonical history-dependent policy: permit SellShares only if the **same |
| write_after_read_formerly | The flagship history-dependent policy in the guide’s literal wording: permit a |