# PolicyEffect

Effect of a policy statement, whether it permits or forbids the action.

- Source: [`aws-bedrockagentcore/lib/policy/policy-statement.ts`](https://github.com/aws/aws-cdk/blob/v2.275.0/packages/aws-cdk-lib/aws-bedrockagentcore/lib/policy/policy-statement.ts#L21)
- Type last changed: v2.269.0 · 10 Sep 2026

## Example

```ts
declare const policyEngine: agentcore.PolicyEngine;
declare const gateway: agentcore.Gateway;

// Allow access unless the user is suspended
const policyWithUnless = new agentcore.Policy(this, "UnlessPolicy", {
  policyEngine: policyEngine,
  policyName: "unless_suspended",
  statement: new agentcore.PolicyStatement({
    effect: agentcore.PolicyEffect.PERMIT,
    principal: agentcore.PolicyPrincipal.entityType('AgentCore::OAuthUser'),
    action: agentcore.PolicyAction.any(),
    resource: agentcore.PolicyResource.instance('AgentCore::Gateway', gateway.gatewayArn),
    unless: [
      agentcore.PolicyCondition.booleanEquals(
        agentcore.PolicyAttribute.principal('suspended'), true),
    ],
  }),
  description: "Allow all actions unless user is suspended",
  validationMode: agentcore.PolicyValidationMode.FAIL_ON_ANY_FINDINGS,
});

// Generated Cedar:
// permit(
//   principal is AgentCore::OAuthUser,
//   action,
//   resource == AgentCore::Gateway::"arn:..."
// )
// unless {
//   principal.suspended == true
// };
```

## Members

| Member | Description |
| --- | --- |
| `PERMIT` | Permit the action when the statement matches and its conditions hold. |
| `FORBID` | Forbid the action when the statement matches and its conditions hold. |

## Referenced by

- [`PolicyStatementProps`](/v2/docs/aws-cdk-lib.aws_bedrockagentcore.PolicyStatementProps).effect