> **Experimental**
>
> `@aws-cdk/aws-bedrock-agentcore-alpha` is an [**experimental**](/stability) (alpha) package: its API may change in any release, without a major version bump.
# PolicyProps

Properties for creating a Policy resource.

Extends: PolicyProps
Used as props by: Policy

- Stability: [Experimental](/cdk/api/stability.html)
- Source: [`lib/policy/policy.ts`](https://github.com/aws/aws-cdk/blob/v2.275.0-alpha.0/packages/@aws-cdk/aws-bedrock-agentcore-alpha/lib/policy/policy.ts#L21)

## Example

```ts
declare const policyEngine: agentcore.PolicyEngine;

// Option 1: Using definition property
const advancedPolicy = new agentcore.Policy(this, "AdvancedPolicy", {
  policyEngine: policyEngine,
  definition: 'permit(principal, action, resource) when { context.custom > 10 };',
  description: "Advanced policy with custom Cedar logic",
});

// Option 2: Using fromCedar() with statement property
policyEngine.addPolicy("CustomPolicy", {
  statement: agentcore.PolicyStatement.fromCedar(
    'forbid(principal, action, resource) when { resource.confidential == true };'
  ),
  description: "Custom policy from Cedar string",
});
```

## Properties

- `definition`: string — Cedar policy statement. The authorization policy written in Cedar policy language.

  **Default:** Must provide either definition or statement

  Cedar supports permit and forbid rules with conditions.
  The statement will be wrapped in a PolicyDefinition structure internally.

  Pass the raw Cedar statement as a string. For example:
  - "permit(principal, action, resource);"
  - "permit(principal in Group::\"Admins\", action == Action::\"InvokeModel\", resource) when { context.environment == \"production\" };"

  You must specify either `definition` or `statement`, but not both.

- `description`: string — Optional description for the policy.

  **Default:** No description

  Maximum length of 4096.

- `policyEngine`: [IPolicyEngine](/cdk/api/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.IPolicyEngine.html) (required) — The policy engine this policy belongs to.

  [disable-awslint:prefer-ref-interface]

- `policyName`: string — The name of the policy.

  **Default:** Auto-generated unique name

  Valid characters: a-z, A-Z, 0-9, _ (underscore)
  Must start with a letter, 1-48 characters
  Pattern: ^[A-Za-z][A-Za-z0-9_]*$

- `statement`: [PolicyStatement](/cdk/api/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.PolicyStatement.html) — Type-safe Cedar policy statement built using PolicyStatement builder.

  **Default:** Must provide either definition or statement

  Use this for a type-safe, form-like API to build Cedar policies without
  writing raw Cedar syntax. The builder validates at synthesis time.

  You must specify either `definition` or `statement`, but not both.

- `validationMode`: [PolicyValidationMode](/cdk/api/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.PolicyValidationMode.html) — Validation mode for the policy.

  **Default:** PolicyValidationMode.FAIL_ON_ANY_FINDINGS

  Controls how Cedar analyzer validation findings are handled.