Policy
A policy is a rule, strategy, or mapping that governs or determines decisions, actions, permissions, or behavior under specified conditions.
Authorization in Action
An authorization policy is a declarative rule or set of rules that determines which subjects may perform which actions on which resources under specified conditions.
- How it is used
- Expresses changing business and security access requirements as runtime-evaluated rules instead of embedded permission checks.
- How deep it goes
- Defines policy vocabulary and structure, then develops Cedar authoring patterns, schema guardrails, request mapping, and testing.
- Examples
- Uses team-report hours, managed devices, confidential documents, financial-data clearance, document ownership, reader teams, and manager relationships.
- What you can do after
- Build it from scratch with Cedar policies that combine ownership, teams, managers, attributes, constraints, schemas, and tests.
ASP.NET Core in Action, 3e
An authorization policy is a named set of requirements that determines whether an authenticated subject may access a protected resource or operation.
- How it is used
- Restricts Razor Pages, MVC actions, and minimal API endpoints according to named authorization requirements.
- How deep it goes
- Develops policy registration and application through custom requirements, handlers, explicit failure, and resource-aware evaluation.
- Examples
- Uses boarding-pass access, age and eligibility checks for a lounge, and ownership checks for recipe operations.
- What you can do after
- Build it from scratch with named policies and custom handlers, or apply it via [Authorize], RequireAuthorization(), and IAuthorizationService.
Optimization Algorithms: AI techniques for design, planning, and control problems
A policy is a reinforcement-learning decision rule that maps observed states or observations to actions or action probabilities.
- How it is used
- Frames reinforcement learning as finding a decision rule that maximizes expected cumulative reward in an environment.
- How deep it goes
- Defines policy forms and works through A2C actor-critic updates, while treating PPO chiefly through its clipped-update intuition and library use.
- Examples
- Uses traffic merging, CartPole control, PyTorch actor and critic networks, and Stable-Baselines3 A2C and PPO training.
- What you can do after
- Build it from scratch with a PyTorch A2C actor, or apply it via Stable-Baselines3 and evaluate CartPole rewards.
Build a Robo-Advisor with Python (From Scratch)
A policy is a rule or mapping that specifies which action an agent should take for each state.
- How it is used
- Guides goals-based investment actions by mapping wealth and time states to stock-bond allocations.
- How deep it goes
- Works through dynamic-programming and Q-learning policy construction, including value functions, state-action values, updates, and simulated episodes.
- Examples
- Uses a $1 million, 10-year wealth-doubling goal and good, medium, and bad wealth paths to compare allocations.
- What you can do after
- Build it from scratch by computing state-dependent asset allocations with dynamic programming or learning them through Q-learning episodes.
Read how Build a Robo-Advisor with Python (From Scratch) explains policy →
Reinforcement Learning from Human Feedback
A policy is a function that maps an environment state to a probability distribution over actions.
- How it is used
- Positions the trainable model as the decision-maker optimized for reward in RL and RLHF.
- How deep it goes
- Defines policies through trajectory probabilities and explains direct gradient updates, while deferring algorithm-specific implementation details.
- Examples
- Uses thermostat heater control and CartPole corrective pushes to illustrate policies learned from initially random behavior.
- What you can do after
- Evaluate/understand how action probabilities shape trajectories and how reward signals reinforce or suppress sampled actions.
Read how Reinforcement Learning from Human Feedback explains policy →
Causal AI
A policy is a rule or mapping that selects an action from observed variables, potentially through a stochastic process.
- How it is used
- Deploys observed state or history to select actions in automated decision-making, bandits, reinforcement learning, and causal interventions.
- How deep it goes
- Defines policy notation, stochastic intervention semantics, sequential histories, DAG changes, confounding, and MDP implementation challenges.
- Examples
- Uses randomized interventions, portfolio allocation, game-playing agents, bandit feedback, and history-based pain-medication dosing.
- What you can do after
- Evaluate and compare policies using utility, counterfactual outcomes, regret, causal graphs, and confounding adjustments.
Google Anthos in Action
A policy is a declarative rule that specifies required behavior, configuration, or access conditions for managed resources.
- How it is used
- Controls workload access, secure communication, and permitted Kubernetes configurations across service meshes and managed clusters.
- How deep it goes
- Explains policy purposes, enforcement locations, supported traffic types, security risks, and cluster scope, but does not show policy manifests.
- Examples
- Uses Istio authorization rules, ACM mTLS policies, Gatekeeper controls, and risky Kubernetes manifest fields as concrete policy cases.
- What you can do after
- Operate policy controls to restrict service traffic, secure cluster communication, and prevent dangerous workload configurations.
Microsoft Azure in Action
An access policy is a defined set of rules that determines whether a user or group may access a service or resource.
- How it is used
- Uses rules to control access to Azure services and data, including enforcing MFA for selected users or groups.
- How deep it goes
- Defines policy structure and demonstrates MFA configuration, while deferring detailed authentication grants.
- Examples
- Demonstrates an MFA policy for Alpaca-Ma-Bags using an Entra ID user group and an MFA access grant.
- What you can do after
- Configure an Entra ID conditional access policy that requires MFA from selected users or groups.
Terraform in Depth: Infrastructure as Code with Terraform and OpenTofu
A policy is a rule set that governs technical, compliance, financial, or contractual decisions about infrastructure and software.
- How it is used
- Uses policies to grant IAM permissions and enforce technical, compliance, financial, or contractual decisions in infrastructure code.
- How deep it goes
- Explains IAM role wiring and walks through a Rego naming rule, while directing readers to plugin documentation for fuller policy construction.
- Examples
- Uses GP3 versus GP2 storage and a required S3 bucket-name prefix to illustrate enforceable decisions.
- What you can do after
- Apply it via TFLint’s OPA plugin to flag a naming violation, or diagnose Checkov findings and document intentional exceptions.
Read how Terraform in Depth: Infrastructure as Code with Terraform and OpenTofu explains policy →
.NET in Action, Second Edition
An authorization policy is a set of access-control rules composed of requirements that determine whether an authenticated principal may perform an action.
- How it is used
- Restricts API actions by applying named requirements to authenticated principals.
- How deep it goes
- Defines policies, schemes, requirements, handlers, and claim checks, but stops short of broader policy design.
- Examples
- Uses AuthenticatedUsers and OnlyMe policies on catalog read and mutation actions, with a preferred_username claim check.
- What you can do after
- Build it from scratch by registering named ASP.NET Core policies and handlers, then applying them to controller actions.
Bayesian Optimization in Action
A policy is a decision rule that determines an action from the information available to an optimization procedure.
- How it is used
- Guides action selection in optimization-under-uncertainty problems with limited trials and uncertain rewards.
- How deep it goes
- Defines the decision rule through slot-machine choices and explains its exploration–exploitation tradeoff.
- Examples
- Uses rows of slot machines, unknown reward probabilities, limited pulls, and coin rewards as concrete examples.
- What you can do after
- Apply it to choose actions that maximize cumulative reward while balancing exploration and exploitation.
Building Web APIs with ASP.NET Core
An authorization policy is a named set of requirements that determines whether an authenticated principal may perform an operation.
- How it is used
- Uses named requirements to authorize operations when role checks alone cannot express the needed claim conditions.
- How deep it goes
- Shows policy registration, endpoint application, claim combinations, and assertion logic, while deferring full implementation of the example.
- Examples
- Demonstrates ModeratorWithMobilePhone and MinAge18 policies using claims, roles, and assertion-based date checks.
- What you can do after
- Apply named policies through Program.cs registration and the Authorize attribute.
Read how Building Web APIs with ASP.NET Core explains policy →
Transformers in Action
A policy is a model or probability distribution that determines the actions or responses produced in a decision-making process.
- How it is used
- Uses policy to select actions in MDPs and to steer language-model outputs toward human preferences.
- How deep it goes
- Defines state-based action selection, then contrasts reward-model optimization with DPO’s direct policy adjustment and KL-divergence constraint.
- Examples
- Uses a dog obstacle course, portfolio construction, preferred-response labels, and direct language-model preference optimization.
- What you can do after
- Understand how policies select actions and how DPO favors preferred language-model responses without an explicit reward model.
Related concepts
- attributeuses · An attribute is a named property, value, or piece of information associated with an entity, object, or program element.
- attribute-based access controlused by · Attribute-based access control is an authorization model that evaluates subject, resource, action, and contextual attributes against policies to make access decisions.
- multi-armed banditincludes · A multi-armed bandit is a sequential decision problem in which an agent chooses among options with uncertain rewards, balancing reward seeking with gathering information about those options.
- reinforcement learningproduced by · Reinforcement learning is a machine-learning paradigm in which an agent learns actions or a policy through interaction with an environment and evaluative feedback, such as rewards.
- actionproduces · An action is a choice or operation selected or performed by an actor that can affect a system or environment or produce an outcome.
- stateuses · State is information or a configuration describing the condition of a system, entity, or computation at a particular time and potentially influencing subsequent behavior or decisions.
These guides are generated from the text of Manning books by Manning's knowledge graph and link to the sections they draw on. The full books are available on liveBook and at manning.com.