> **Experimental**
>
> `@aws-cdk/aws-bedrock-agentcore-alpha` is an [**experimental**](/stability) (alpha) package: its API may change in any release, without a major version bump.
# PolicyValidationMode

Validation mode for Cedar policy definitions.

- Stability: [Experimental](/cdk/api/stability.html)
- Source: [`lib/policy/policy-types.ts`](https://github.com/aws/aws-cdk/blob/v2.275.0-alpha.0/packages/@aws-cdk/aws-bedrock-agentcore-alpha/lib/policy/policy-types.ts#L7)

## Example

```ts
declare const policyEngine: agentcore.PolicyEngine;
declare const gateway: agentcore.Gateway;

// Allow access unless the user is suspended
const policyWithUnless = new agentcore.Policy(this, "UnlessPolicy", {
  policyEngine: policyEngine,
  policyName: "unless_suspended",
  statement: agentcore.PolicyStatement.permit()
    .forPrincipal('AgentCore::OAuthUser')
    .onAllActions()
    .onResource('AgentCore::Gateway', gateway.gatewayArn)
    .unless()
      .principalAttribute('suspended').equalTo(true)
      .done(),
  description: "Allow all actions unless user is suspended",
  validationMode: agentcore.PolicyValidationMode.FAIL_ON_ANY_FINDINGS,
});

// Generated Cedar:
// permit(
//   principal is AgentCore::OAuthUser,
//   action,
//   resource == AgentCore::Gateway::"arn:..."
// )
// unless {
//   principal.suspended == true
// };
```

## Initializer

```ts
new PolicyValidationMode(value: string)
```

## Properties

- `FAIL_ON_ANY_FINDINGS`: [PolicyValidationMode](/cdk/api/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.PolicyValidationMode.html) (static) — Fail policy creation if any validation findings are detected.

  This is the safer default - catches policy errors early.

- `IGNORE_ALL_FINDINGS`: [PolicyValidationMode](/cdk/api/v2/docs/@aws-cdk_aws-bedrock-agentcore-alpha.PolicyValidationMode.html) (static) — Ignore all validation findings and create the policy anyway.

  Use with caution - may result in runtime authorization errors.

- `value`: string — The string value of the validation mode.