# Integrate my own policy engine to Openziti **URL:** \ **Category:** Uncategorized\ **Created:** [March 13, 2025, 1:48pm UTC](https://openziti.discourse.group/t/integrate-my-own-policy-engine-to-openziti/4147 "2025-03-13T13:48:29Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![marchnair256](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/marchnair256/32/3292_2.png) [@marchnair256](https://openziti.discourse.group/u/marchnair256)\ **Post date:** [March 13, 2025, 1:48pm UTC](https://openziti.discourse.group/t/integrate-my-own-policy-engine-to-openziti/4147/1 "2025-03-13T13:48:29Z")
Hi, If I want to write my own policy engine (that is more flexible to allow automation) into the OpenZiti Github code, where can I start? Should I be looking at replacing the "controller" directory with my own? Thanks, Anita ---
**Author:** ![qrkourier](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/qrkourier/32/52_2.png) [@qrkourier](https://openziti.discourse.group/u/qrkourier)\ **Post date:** [March 13, 2025, 1:54pm UTC](https://openziti.discourse.group/t/integrate-my-own-policy-engine-to-openziti/4147/2 "2025-03-13T13:54:16Z")
Welcome, Anita! Would it meet your needs to have an API implementation for managing policies and perhaps other entities? If so, what programming language? I may be able to local additional resources. Here is the management API reference: [Edge Management API Reference | OpenZiti](https://openziti.io/docs/reference/developer/api/edge-management-reference) FYI: in case of confusion, [these "edge" SDKs](https://openziti.io/docs/reference/developer/sdk/), they implement the "client" API, not the management API. ---
**Author:** ![marchnair256](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/marchnair256/32/3292_2.png) [@marchnair256](https://openziti.discourse.group/u/marchnair256)\ **Post date:** [March 13, 2025, 2:07pm UTC](https://openziti.discourse.group/t/integrate-my-own-policy-engine-to-openziti/4147/3 "2025-03-13T14:07:22Z")
Thank you for the reference, Ken. Would this API allow me to add policies that allow/deny access to certain devices/users/applications. Example, I want to add a policy like: Source/Destination/AllowOrDeny IP\_Address\_1:Port\_1/Resource\_1/Deny IP\_Address\_2:Port\_2/Resource\_2/Allow Identity\_1/Resource\_1/Deny etc ---
**Author:** ![qrkourier](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/qrkourier/32/52_2.png) [@qrkourier](https://openziti.discourse.group/u/qrkourier)\ **Post date:** [March 13, 2025, 2:18pm UTC](https://openziti.discourse.group/t/integrate-my-own-policy-engine-to-openziti/4147/4 "2025-03-13T14:18:51Z")
Yes, that's exactly what it's for. A quick way to orient to the management API is to explore the sub-commands of the `ziti edge` CLI, which implements Ziti's management API's operations. ```bash ❯ ziti edge Manage the Edge components of a Ziti network using the Ziti Edge REST API Usage: ziti edge [command] Available Commands: create creates various entities managed by the Ziti Edge Controller db Database management operations for the Ziti Edge Controller delete deletes various entities managed by the Ziti Edge Controller enroll enroll an identity list Lists various entities managed by the Ziti Edge Controller login logs into a Ziti Edge Controller instance logout logs out of a Ziti Edge Controller instance policy-advisor runs sanity checks on various policy related entities managed by the Ziti Edge Controller quickstart runs a Controller and Router in quickstart mode re-enroll re-enrolls various entities managed by the Ziti Edge Controller show displays various entities managed by the Ziti Edge Controller trace manages tracing by the Ziti Edge Controller traceroute runs a traceroute on the service update updates various entities managed by the Ziti Edge Controller use changes which saved login to use with a Ziti Edge Controller instance validate validate model data verify verifies various entities managed by the Ziti Edge Controller version Returns the version information reported by the edge controller Flags: -h, --help help for edge Use "ziti edge [command] --help" for more information about a command. ``` ---
**Author:** ![qrkourier](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/qrkourier/32/52_2.png) [@qrkourier](https://openziti.discourse.group/u/qrkourier)\ **Post date:** [March 13, 2025, 2:26pm UTC](https://openziti.discourse.group/t/integrate-my-own-policy-engine-to-openziti/4147/5 "2025-03-13T14:26:09Z")
In my opinion, this is the best introduction to the expressiveness of Ziti policies: [Policies | OpenZiti](https://openziti.io/docs/learn/core-concepts/security/authorization/policies/overview) TL;DR Three types of policies and entities form an authorization triangle that must be completed for traffic to flow. You can set permissive router policies if you don't need geofencing or traffic steering and control access exclusively with service policies. ---
**Author:** ![PhilipGriffiths](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/philipgriffiths/32/341_2.png) [@PhilipGriffiths](https://openziti.discourse.group/u/PhilipGriffiths)\ **Post date:** [March 13, 2025, 2:31pm UTC](https://openziti.discourse.group/t/integrate-my-own-policy-engine-to-openziti/4147/6 "2025-03-13T14:31:09Z")
Another wy to describe it, we inside NetFoundry do not give our engineers access to customer resources, unless a customer opens a support ticket and the assigned engineer gets services defined only for the duration the ticket is open - [Business Rule Driven Just-in-Time Network Access](https://blog.openziti.io/business-rule-driven-just-in-time-network-access) - all via the API @qrkourier describes. ---
**Author:** ![marchnair256](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/marchnair256/32/3292_2.png) [@marchnair256](https://openziti.discourse.group/u/marchnair256)\ **Post date:** [March 13, 2025, 4:10pm UTC](https://openziti.discourse.group/t/integrate-my-own-policy-engine-to-openziti/4147/7 "2025-03-13T16:10:51Z")
Ken, Are there test codes that implement the Edge Management API, specifically the Policy Engine / Controller APIs? I am going to be using Python for my scripts. Thank you, Anita ---
**Author:** ![qrkourier](https://yyz2.discourse-cdn.com/free1/user_avatar/openziti.discourse.group/qrkourier/32/52_2.png) [@qrkourier](https://openziti.discourse.group/u/qrkourier)\ **Post date:** [March 13, 2025, 4:15pm UTC](https://openziti.discourse.group/t/integrate-my-own-policy-engine-to-openziti/4147/8 "2025-03-13T16:15:22Z")
Yes, but due to API changes, the Python-generated API client for the management API will probably need to be regenerated. blog: [OpenAPI Python Clients](https://blog.openziti.io/openapi-python-clients) mgmt API client: [GitHub - openziti-test-kitchen/openziti-edge-management-python: Python library for the Ziti Management API](https://github.com/openziti-test-kitchen/openziti-edge-management-python?tab=readme-ov-file#readme)