Create a policy to protect Credit Card Number (CCN) on

Initialize Policy Management

Mon, 01 Jan 0001 00:00:00 +0000

This step initializes the Policy Management system. This step needs to be executed only once.

CLI Code

pim invoke init

CLI Actual Output

✅ PIM successfully initialized (bootstrapped).

API Endpoint

Create Role

Mon, 01 Jan 0001 00:00:00 +0000

What you are doing

Creating the role that represents who can perform operations against the data element.

Why it matters

Permissions are granted to roles and roles map to users or groups, ideally from member sources.

Tips

Create Policy Shell

Mon, 01 Jan 0001 00:00:00 +0000

What you are doing

Creating the policy that will hold the access rules. For example, Data Element, Role, and Rules.

Why it matters

The policy is the object that ties together the pieces and becomes deployable.

Tips

Multiple Roles, multiple data elements, and their corresponding rules can be added to a single policy. Consider structuring your policy around specific areas of focus, as in this example, the treatment of a Credit Card Number across the entirety of your enterprise.

Define Rule with Data Element and Role

Mon, 01 Jan 0001 00:00:00 +0000

What you are doing

Creating the policy rule that binds:

A role: Who.
A data element: What.
Permitted operations: Protect, Reprotect, or Unprotect.

Why it matters

This binding is what makes the policy enforceable. Without rules, the policy exists but grants no access.

Tips

This rule grants the specified role permission to protect the CCN data element, while disallowing reprotect and unprotect.

CLI Code

Create Datastore

Mon, 01 Jan 0001 00:00:00 +0000

What you are doing

Creating the datastore target where a policy will be deployed.

Why it matters

A policy is not active for protectors until it is deployed to a datastore.

CLI Code

Deploy Policy to a Datastore

Mon, 01 Jan 0001 00:00:00 +0000

What you are doing

Deploying the policy to the datastore so protectors that target that datastore can load the policy.

Why it matters

Until the policy is deployed, the policy is not available to runtime protectors.

Tips

Confirm Deployment

Mon, 01 Jan 0001 00:00:00 +0000

What you are doing

Confirming which policies are deployed to which datastores.

Why it matters

Verifying deployment confirms the policy is active, correctly mapped, and enforceable.

CLI Code

pim get deploy

CLI Actual output