> **Experimental**
>
> `@aws-cdk/aws-bedrock-agentcore-alpha` is an [**experimental**](/stability) (alpha) package: its API may change in any release, without a major version bump.
# AddPolicyOptions

Options for adding a policy via PolicyEngine.addPolicy().

- Stability: [Experimental](/cdk/api/stability.html)
- Source: [`lib/policy/policy-types.ts`](https://github.com/aws/aws-cdk/blob/v2.275.0-alpha.0/packages/@aws-cdk/aws-bedrock-agentcore-alpha/lib/policy/policy-types.ts#L33)

## Example

```ts
declare const policyEngine: agentcore.PolicyEngine;
declare const gateway: agentcore.Gateway;

// Allow specific tool actions on specific gateway
// Action names follow pattern: "ToolName__operation"
policyEngine.addPolicy("SpecificToolPolicy", {
  statement: agentcore.PolicyStatement.permit()
    .forPrincipal('AgentCore::OAuthUser::your-client-id')
    .onActions([
      'AgentCore::Action::WeatherTool__get_forecast',
      'AgentCore::Action::WeatherTool__get_current',
    ])
    .onResource('AgentCore::Gateway', gateway.gatewayArn),
  description: "Allow specific weather tool operations",
  validationMode: agentcore.PolicyValidationMode.FAIL_ON_ANY_FINDINGS,
});

// Generated Cedar:
// permit(
//   principal is AgentCore::OAuthUser,
//   action in [
//     AgentCore::Action::"WeatherTool__get_forecast",
//     AgentCore::Action::"WeatherTool__get_current"
//   ],
//   resource == AgentCore::Gateway::"arn:aws:bedrock-agentcore:us-east-1:123:gateway/gw-123"
// );
```

## Properties

- `definition`: string — Cedar policy statement (35-153,600 characters).

  **Default:** Must provide either definition or statement

  You must specify either `definition` or `statement`, but not both.

- `description`: string — Optional description for the policy (max 4,096 characters).

  **Default:** No description

- `policyName`: string — The name of the policy.

  **Default:** Auto-generated unique name

  Valid characters: a-z, A-Z, 0-9, _ (underscore)
  Must start with a letter, 1-48 characters

- `statement`: [PolicyStatement](/cdk/api/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.PolicyStatement.html) — Type-safe Cedar policy statement built using PolicyStatement builder.

  **Default:** Must provide either definition or statement

  Use this for a type-safe, form-like API to build Cedar policies without
  writing raw Cedar syntax. The builder validates at synthesis time.

  You must specify either `definition` or `statement`, but not both.

- `validationMode`: [PolicyValidationMode](/cdk/api/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.PolicyValidationMode.html) — Validation mode for the policy.

  **Default:** PolicyValidationMode.FAIL_ON_ANY_FINDINGS