---
title: keycard-upsert-policy | Keycard
description: Propose, confirm, and apply a Cedar policy change — propose → confirm → write → verify.
---

Propose, confirm, and apply a Cedar policy change — propose → confirm → write → verify.

## When to Use

Use this skill when you want to:

- Change, add, remove, enable, or disable a policy rule
- Allow, deny, grant, restrict, or block a specific tool or action
- Add ITL (in-the-loop) gating to a tool

Do **not** use this skill to ask questions about what is currently allowed or why something was blocked — use `keycard-query-policy` for that.

## Arguments

`[policy change request, e.g. 'Allow the Bash tool' or 'Require approval for WebFetch']`

## Examples

- “Allow the Bash tool”
- “Block WebFetch”
- “Require human approval before Edit runs”
- “Add ITL gating to the Write tool”
- “Remove the restriction on Read”